Legal
Security
Last updated: Not yet adopted
Placeholder — not the final document.
This page sets out the structure the security will follow. It has not been reviewed by counsel, it creates no obligations, and nothing on it should be relied on. If you need the real terms before they're published, write to hello@foraos.io.
This page will describe how Fora is built and operated, in enough detail for a security reviewer to do their job. The outline below is the structure it will follow. Nothing here should be relied on until it is replaced with reviewed text.
01Tenancy and isolation
How one customer's data is kept apart from another's, and what enforces it at the database level rather than in application code. To be written by counsel.
02Authentication and access
Sign-in, single sign-on via SAML and OIDC, SCIM provisioning, role-based access, and how scoped guests are limited. To be written by counsel.
03Encryption
In transit and at rest, with the specifics a reviewer will ask for. To be written by counsel.
04Hosting and sub-processors
Where Fora runs, which providers are involved, and in which regions data is stored. To be written by counsel.
05Logging and audit
What the audit log records, who can read it, and how long entries are kept. To be written by counsel.
06Backups and recovery
Backup frequency, retention, and the recovery objectives we hold ourselves to. To be written by counsel.
07Vulnerability handling
How to report something to us, what we commit to in response, and how we disclose. To be written by counsel.
08Certifications
Any audit or certification Fora actually holds. We will list none until one is genuinely in place. To be written by counsel.