Trust and procurement

Your reviewer needs a status, not a disclaimer.

Forge has a built and tested enterprise integration candidate. This page gives vendor risk what it actually asks for: vendor-security answers, no product training on customer data, an IP-safe architecture overview, counsel-review legal templates, and a current status on SOC 2, penetration testing, cyber insurance, CMMC, FedRAMP, and ATO. Enough for diligence. Nothing that pretends to be more.

What is ready Security posture Architecture boundary Legal path Status

The procurement set is ready in layers.

Public before fit	Trust page, public API overview, onboarding path, vulnerability disclosure, privacy, terms, and this procurement map.
After workflow fit	Vendor-security one-pager, no customer-data training statement, data-handling memo, and workflow-specific integration brief.
Security review	CAIQ/SIG-style answer bank, non-sensitive architecture overview, deployment options, and current attestation status.
Counsel review	NDA, DPA, MSA terms, and integration order-form drafts are available as starting points for counsel. They are not executed terms.

The security posture is stated in plain English.

Data

No product training on customer data.

Forge does not learn across customers. The default is no retention: no calibration row is written. Tenant-local calibration measurement requires an authorized outcome plus a separate, explicit, contracted retention opt-in.

Proof

No generative model in the checked path.

The proof trail is deterministic and replayable. Extraction may happen before the checked path and must stay cited.

Review

Verification has a boundary.

Against an independently provisioned full signing-key ID, verification checks complete-record integrity and signer attribution. Replay separately checks reproducibility from the recorded basis. Neither certifies the customer's evidence or business judgment.

The controls are built. The first scope is one integration. Tenant scoping, encryption controls, explicit learning-rights handling, complete-record signing, deterministic replay, access controls, and audit logging are in the engine today. The 30-day engagement exercises one agreed workflow; every wider rollout remains separately scoped and qualified.

Architecture overview

Useful enough for review, not an IP leak.

Customer systems stay authoritative. Source systems, evidence vaults, policy authority, and final decision authority stay with the buyer.
Forge receives bounded evidence. One named workflow sends the evidence and action menu needed for a proof trail. The product schema and integration contract are supplied through the scoped technical review; tenant-specific mappings and credentials remain private.
Forge returns proof. The result includes the supported action, evidence path, uncertainty, human-review boundary, replay path, and integrity check.
One API, and the base URL picks the host. Hosted, customer-operated, isolated, and on-premises deployments run the same code against the same contract: an API key and a base URL. Sensitivity decides where it runs, not what gets built. For sensitive workflows the on-premises, customer-hosted path is contract-scoped, which keeps Forge out of the customer data path.

Legal and procurement documents are staged for counsel, not public download.

Forge has starting-point materials for a mutual NDA, data processing addendum, master services terms, and integration order form. Those materials help the buyer's counsel move quickly after fit, but they are not legal advice and are not binding until reviewed and signed by the parties.

NDA and security review.

Open the deeper questionnaire and architecture materials after workflow fit and the right review channel.

Data and deployment terms.

Set data boundary, retention, deletion, subprocessors, hosted or on-premises path, and security responsibilities.

Integration order form.

Name the decision surface, acceptance criteria, technical owner, review owner, and next-scope trigger.

Here is what is certified and what is not.

SOC 2	Not certified. SOC 2 is not claimed. Readiness work is staged for the enterprise review path.
Third-party security assessment	Not completed or scheduled. Independent application and cryptographic assessment scopes are prepared; no report, certification, or completion date is claimed.
Cyber insurance	Not yet bound; being placed ahead of buyer paper.
CMMC, FedRAMP, ATO	No CMMC status or certification, FedRAMP authorization, or ATO is claimed. CMMC Level 1 evidence work and Level 2 enclave planning are readiness work only, not a submitted SPRS score or certification.
Federal credential	The Forge solution was assessed as Awardable on the U.S. Department of Defense CDAO Tradewinds Solutions Marketplace.

Business and registration, ready to paste into a vendor record.

Legal entity	Forge Orbital Inc.
SAM.gov	Active registration, renews 2027-06-30.
CAGE code	1ASL5
UEI	FNMHTCGY8FK3
Business size	General small business. No set-aside socioeconomic status is claimed.

Give procurement the right artifact at the right time.

Before fit, the public pages should answer the shape of the review. After fit, Forge can hand over the questionnaire answers, architecture overview, and counsel-review materials for that buyer and workflow.

Start procurement review Read trust posture See onboarding