Security

Our approach

Security is built into how Forman is designed and run. We follow the principle of least privilege, keep our stack modern and patched, and treat customer data as something we are trusted to protect. This page summarises the main measures in place.

Infrastructure and hosting

Forman runs on established cloud infrastructure (Vercel for the application and Supabase for the database), with data encrypted in transit using TLS and encrypted at rest by our providers. Uploaded files are stored in access-controlled storage. We rely on providers that maintain their own recognised security certifications.

Access controls and authentication

• Access to production systems is restricted to authorised personnel on a least-privilege basis.
• Accounts are protected by secure authentication and hashed credentials.
• Administrative access is limited and logged.
• Secrets and API keys are stored in managed secret storage, not in code.

Application security

• Session protection and secure cookies for signed-in users.
• Verification of inbound webhooks from payment and messaging providers.
• Rate limiting on sensitive endpoints to reduce abuse.
• Input validation and output encoding to guard against common web vulnerabilities.

Monitoring, logging and backups

We keep audit and security logs to detect and investigate issues, and our database provider maintains regular backups to support recovery. We monitor for errors and unusual activity so we can respond quickly.

Payments

Card payments are handled by our PCI-DSS-compliant payment providers, Stripe and Revolut. Forman does not store full card numbers; sensitive payment details are processed directly by those providers.

Secure development

Changes are reviewed and tested before release, dependencies are kept up to date, and we run automated checks and a production build on every change. We aim to fix security-relevant issues promptly.

Incident response and breach notification

We maintain an incident-response process. If a personal data breach affects you, we will act to contain it and, where legally required, notify the ICO and affected users without undue delay, in line with UK GDPR.

Subprocessors and data location

We use a small set of vetted providers to deliver the service. The current list, with purposes, is at /subprocessors/. Some providers process data outside the UK under appropriate safeguards, as explained in our Privacy Notice.

Responsible disclosure

If you believe you have found a security vulnerability in Forman, please email support@forman.live with details. We welcome responsible disclosure and will work with you to investigate and resolve genuine issues. Please do not access or modify other users' data or disrupt the service while testing.