ForgeTrack stores the raw material of R&D tax filings, investor diligence packets, and engineering substantiation. That data must survive multi-year retention, adversarial audits, and the eventual scrutiny of third parties who did not witness it being created. The architecture below describes how.
Each layer is independent. A compromise at one layer does not cascade into others.
Multi-tenant isolation is architectural, not configurational. Every row in every table carries a tenant identifier, every query carries a scoped predicate, and every export is scoped at the SQL level — not the application level. A classifier mistake in one tenant cannot leak data into another.
Role-based access with four defined roles: owner, admin, member, viewer. Enterprise tier adds SSO/SAML with Azure AD, Okta, and Google Workspace. Session tokens are short-lived, refresh is audited, and permission changes are logged as events in the same append-only store used for evidence.
The GAAIM event log is append-only by construction. Deleting an event is not a supported operation; correcting one means writing a new event that references the corrected one. Every log entry is signed with a SHA-256 content hash. Post-facto tampering is detectable against the hash chain.
Every AI provider runs under a per-tenant credential. No shared keys, no connection pooling across tenants, no prompt leakage between contexts. Provider responses are hashed and stored as first-class events — not as logs of API calls, but as evidence artifacts in their own right.
Default tenancy is Azure US. Enterprise customers can request EU (Frankfurt, Dublin) or UK South at onboarding. All data at rest is encrypted with customer-managed keys on the Enterprise tier; lower tiers use Microsoft-managed keys with per-tenant envelope encryption.
Security reports are routed to [email protected] and triaged within 24 hours. We publish advisories for any issue that affects report integrity, data isolation, or authentication. Coordinated disclosure timelines are negotiated case-by-case.
ForgeTrack is in public beta. SOC 2 Type I is in progress with an established audit firm; SOC 2 Type II and ISO 27001 are on the compliance roadmap for the first full year of general availability.
HIPAA is not in scope for the general-availability product; healthcare customers should treat ForgeTrack as a non-PHI tool. Enterprise customers with specific regulatory requirements can scope a custom posture at contract — including BAAs, residency constraints, and dedicated infrastructure.