Security & Trust
Your congregation's data deserves more than a password.
Forge is built with security as a first principle — role-based access, encryption, and a complete audit trail on every layer. Ministry-focused simplicity. No data selling, ever.
Security Standards You Can Trust
Encrypted In Transit & At Rest
Role-Based Access Control
Nightly Automated Backups
Your Data Is Never Sold
Security Built Into Every Layer
Three pillars protect your ministry's most sensitive information.
Role-Based Access Control
Who sees what is determined by responsibility, not proximity to the pastor.
- Granular permission levels — from view-only to full admin
- Assign roles to individual users or groups
- Restrict access to sensitive data like giving records and care notes
- Admin dashboard to manage all permissions in one place
- Automatic access revocation when staff members leave
Complete Audit Trail
Every action timestamped, traceable, and ready for leadership review.
- Log all data access, modifications, and deletions with exact timestamps
- See who accessed what, when, and why
- Export audit reports for compliance and investigations
- Real-time alerts on sensitive data access
- Audit records retained 7 years by default — configurable per church to match your insurance and legal requirements
Data Protection & Resilience
Encrypted at rest, encrypted in transit, backed up nightly, ready for anything.
- Encryption for all data in transit
- Encryption for all data at rest
- Nightly automated backups to geographically redundant servers
- A documented disaster recovery plan
- Independent security review as part of our path to formal certification
How We Protect Your Data
Every layer of Forge is designed to keep your congregation's information secure.
Encrypted Connections
Nightly Encrypted Backups
Role-Based Access Controls
Session Timeout Policies
Two-Factor Authentication
Independent Security Review
Export Your Data Anytime
Incident Response Plan
Security Questions, Straight Answers
Your data security questions matter. Here are answers from our engineering team.
Is our data encrypted?+
Yes. All data is encrypted both in transit and at rest using strong, industry-standard encryption. Your giving records, care notes, and member information are protected at every layer.
Who can access giving records?+
Only staff members with the appropriate role permission. A worship leader won't see giving data. A finance director can be restricted to view-only. You control every permission.
What happens if someone leaves our staff?+
Their access is revoked immediately. All their previous actions remain logged for accountability. You can even set automatic access expiration dates for volunteers or seasonal staff.
Do you sell our data?+
Absolutely not. We don't sell, share, or broker your data. Period. Your congregation's information is yours alone. We're custodians, not marketers.
Where is our data stored?+
Your data is stored in secure, geographically redundant data centers in North America, and it is always yours to export.
How do you respond to security breaches?+
We have a documented incident response plan with communication protocols, forensic investigation, and remediation steps. We notify affected parties promptly. Transparency is non-negotiable.
Our Commitment
How we think about your data
A church holds things people don't tell anyone else. A marriage under strain. A family walking through a diagnosis. What someone can honestly afford to give. That isn't customer data — it's trust, and it was given to your church, not to us. We treat it that way.
So here's where we stand, in plain language. We do not sell your data. We don't rent it, broker it, or pass it to advertisers. We don't mine your congregation's records to train anything. Your data stays yours — export it whenever you want, and take it with you if you ever decide to leave.
We're also honest about where we are. Forge runs on managed, enterprise-grade infrastructure: encryption in transit and at rest, isolated environments, and automated nightly backups to geographically redundant servers. We've completed an independent security review, and we're working toward formal certification.
We don't claim certifications we haven't earned. Plenty of software will tell you it's compliant with things it has never been audited against. When we hold a certification, we'll name it and show you the report — and not a day before. Until then, judge us on what's actually running, which is everything listed on this page.
Questions about how a specific piece of your data is handled? Ask us directly — a real person will answer, and if the honest answer is "not yet," we'll tell you that instead of selling around it.
Trust is the foundation of ministry.
Let us earn yours. Forge delivers the security your congregation deserves — with the simplicity ministry leaders expect.
Explore by role
See how Forge works for your specific role