MockForge runs your mocks, your specs, and your team's data on shared infrastructure, so isolation, encryption, and an honest audit trail are core engineering, not a checkbox. This page is a plain account of the controls we run today and where we are headed.
At a glance
Every item below is implemented and shipping in the hosted product. We do not list controls we are merely planning.
Every API request is scoped to your organization and authorized against your membership before any data is read or written. We are adding database row-level security as a defense-in-depth backstop so a single application bug cannot cross a tenant boundary. Cross-organization access is denied by default.
Sensitive actions are recorded to an append-only audit log protected by a per-organization cryptographic hash chain. Any edit, deletion, or reordering of a record is detectable. Records survive even if the organization is deleted.
SAML 2.0 and OIDC single sign-on, gated on DNS-verified domain ownership so no one can attach an SSO identity to a domain they do not control. TOTP multi-factor authentication, short-lived session tokens, and bcrypt-hashed passwords.
All traffic is served over TLS 1.2+ with HTTPS enforced. Databases and persistent volumes are encrypted at rest by our infrastructure providers.
Outbound integrations (such as SSO discovery) run behind an SSRF guard that blocks internal, loopback, and cloud-metadata addresses. CSRF protection on state-changing requests and per-organization rate limiting are enforced at the edge of the API.
Bring your own AI provider key; tenant credentials are kept separate from platform workloads. Payment details are handled entirely by Stripe, a PCI-DSS Level 1 provider. MockForge never stores card numbers.
The MockForge core is open source under MIT or Apache-2.0, so you can read exactly how it works, audit it, and run it entirely inside your own network if your data cannot leave it. The hosted product is a convenience, not a lock-in.
We collect what is needed to run the service and nothing we cannot explain. You can export your organization's data and request erasure, and both actions are themselves written to the audit log.
The documents that govern how we handle your data.
We will be straight with you about where we are. MockForge is not yet SOC 2 certified. We are building toward a SOC 2 Type II examination, and many of the controls an auditor looks for are already in place. Here is the honest state of that work.
Pursuing a compliance review and need our current status or security documentation? Get in touch and we will share where things stand.
GDPR: MockForge provides a Data Processing Agreement and supports data export and erasure to help you meet your obligations as a controller.
The hosted product relies on a small set of infrastructure providers. The Data Processing Agreement carries the authoritative, current list.
We welcome coordinated disclosure from security researchers. Report a vulnerability through our security policy and we will acknowledge it and keep you updated through the fix. Please give us a reasonable window before any public disclosure.
The fastest way to evaluate MockForge against your own security requirements is to run it yourself. No account, no data leaving your machine.
Get started free