Trust & Security

Security built into the product, not bolted on after.

MockForge runs your mocks, your specs, and your team's data on shared infrastructure, so isolation, encryption, and an honest audit trail are core engineering, not a checkbox. This page is a plain account of the controls we run today and where we are headed.

At a glance

  • Encrypted in transit (TLS 1.2+) and at rest.
  • Per-organization tenant isolation on every request.
  • SSO (SAML & OIDC) with DNS-verified domains, plus MFA.
  • Tamper-evident, append-only audit log.
  • Open-source core you can read and self-host.

The controls we run today

Every item below is implemented and shipping in the hosted product. We do not list controls we are merely planning.

Tenant isolation

Every API request is scoped to your organization and authorized against your membership before any data is read or written. We are adding database row-level security as a defense-in-depth backstop so a single application bug cannot cross a tenant boundary. Cross-organization access is denied by default.

Tamper-evident audit log

Sensitive actions are recorded to an append-only audit log protected by a per-organization cryptographic hash chain. Any edit, deletion, or reordering of a record is detectable. Records survive even if the organization is deleted.

Authentication & SSO

SAML 2.0 and OIDC single sign-on, gated on DNS-verified domain ownership so no one can attach an SSO identity to a domain they do not control. TOTP multi-factor authentication, short-lived session tokens, and bcrypt-hashed passwords.

Encryption

All traffic is served over TLS 1.2+ with HTTPS enforced. Databases and persistent volumes are encrypted at rest by our infrastructure providers.

Attack-surface hardening

Outbound integrations (such as SSO discovery) run behind an SSRF guard that blocks internal, loopback, and cloud-metadata addresses. CSRF protection on state-changing requests and per-organization rate limiting are enforced at the edge of the API.

Secrets & AI keys

Bring your own AI provider key; tenant credentials are kept separate from platform workloads. Payment details are handled entirely by Stripe, a PCI-DSS Level 1 provider. MockForge never stores card numbers.

Open and self-hostable

The MockForge core is open source under MIT or Apache-2.0, so you can read exactly how it works, audit it, and run it entirely inside your own network if your data cannot leave it. The hosted product is a convenience, not a lock-in.

Your data, and your right to take it back

We collect what is needed to run the service and nothing we cannot explain. You can export your organization's data and request erasure, and both actions are themselves written to the audit log.

  • Data export. Pull your organization's records in a structured format on request.
  • Erasure. Request deletion of personal data in line with GDPR rights.
  • Hosting region. The hosted product runs in the United States. Self-host if you need data to stay in a specific jurisdiction.

Legal & agreements

The documents that govern how we handle your data.

Compliance, and our SOC 2 roadmap

We will be straight with you about where we are. MockForge is not yet SOC 2 certified. We are building toward a SOC 2 Type II examination, and many of the controls an auditor looks for are already in place. Here is the honest state of that work.

In place today

  • Logical tenant isolation and access control
  • Encryption in transit and at rest
  • SSO, MFA, and role-based authorization
  • Tamper-evident, append-only audit logging of authentication, configuration, billing, and data-export events
  • Coordinated vulnerability disclosure process

On the roadmap

  • Database-enforced row-level tenant isolation
  • Formal policy set and access reviews
  • Continuous control monitoring
  • SOC 2 Type II observation window and independent audit

Pursuing a compliance review and need our current status or security documentation? Get in touch and we will share where things stand.

GDPR: MockForge provides a Data Processing Agreement and supports data export and erasure to help you meet your obligations as a controller.

Sub-processors

The hosted product relies on a small set of infrastructure providers. The Data Processing Agreement carries the authoritative, current list.

Fly.io
Application compute and managed PostgreSQL hosting (United States).
Cloudflare
DNS, CDN, TLS edge, and DDoS / WAF protection.
Stripe
Payment processing and subscription billing (PCI-DSS Level 1).
Sentry
Application error monitoring and diagnostics.

Found something? Tell us.

We welcome coordinated disclosure from security researchers. Report a vulnerability through our security policy and we will acknowledge it and keep you updated through the fix. Please give us a reasonable window before any public disclosure.

Start with the free, local tier

The fastest way to evaluate MockForge against your own security requirements is to run it yourself. No account, no data leaving your machine.

Get started free