MockForge runs your mocks, your specs, and your team's data on shared infrastructure, so isolation, encryption, and an honest audit trail are core engineering, not a checkbox. This page is a plain account of the controls we run today and where we are headed.
At a glance
Every item below is implemented and shipping in the hosted product. We do not list controls we are merely planning.
Every API request is scoped to your organization and authorized against your membership before any data is read or written. Beneath that, Postgres row-level security enforces the same boundary on every organization-keyed table: request traffic runs as a database role that cannot bypass it, so a single application bug cannot read or write another tenant's rows. Cross-organization access is denied by default.
Sensitive actions are recorded to an append-only audit log protected by a per-organization cryptographic hash chain. Any edit, deletion, or reordering of a record is detectable. Records survive even if the organization is deleted.
SAML 2.0 and OIDC single sign-on, gated on DNS-verified domain ownership so no one can attach an SSO identity to a domain they do not control. TOTP multi-factor authentication, short-lived session tokens, and bcrypt-hashed passwords.
All traffic is served over TLS 1.2+ with HTTPS enforced, including the hop from Cloudflare's edge to our origin. The production database sits on storage encrypted at rest (LUKS2, AES-XTS). Database backups are encrypted before they leave the server, then stored in Cloudflare R2, which also encrypts stored data at rest, as it does for uploaded files.
Outbound integrations (such as SSO discovery) run behind an SSRF guard that blocks internal, loopback, and cloud-metadata addresses. CSRF protection on state-changing requests and per-organization rate limiting are enforced at the edge of the API.
Bring your own AI provider key; tenant credentials are kept separate from platform workloads. Payment details are handled entirely by Stripe, a PCI-DSS Level 1 provider. MockForge never stores card numbers.
The MockForge core is open source under MIT or Apache-2.0, so you can read exactly how it works, audit it, and run it entirely inside your own network if your data cannot leave it. The hosted product is a convenience, not a lock-in.
We collect what is needed to run the service and nothing we cannot explain. You can export your organization's data and request erasure, and both actions are themselves written to the audit log.
The documents that govern how we handle your data. Questions about them go to [email protected].
We will be straight with you about where we are. MockForge is not yet SOC 2 certified. We are building toward a SOC 2 Type II examination, and many of the controls an auditor looks for are already in place. Here is the honest state of that work.
Planning target: H2 2027 for the SOC 2 Type II examination. Timing depends on control readiness, the observation window, and the independent auditor's schedule. This is a planning target, not a claim of certification.
Pursuing a compliance review and need our current status or security documentation? Get in touch and we will share where things stand.
GDPR: MockForge provides a Data Processing Agreement and supports data export and erasure to help you meet your obligations as a controller.
The hosted product relies on a small set of infrastructure providers. The Data Processing Agreement carries the authoritative, current list.
*.mocks.mockforge.dev), in the region you choose for each deployment.We welcome coordinated disclosure from security researchers. Report a vulnerability through our security policy and we will acknowledge it and keep you updated through the fix. Please give us a reasonable window before any public disclosure.
The fastest way to evaluate MockForge against your own security requirements is to run it yourself. No account, no data leaving your machine.
Get started free