Is my members' data safe?
Here's how Forge handles it, in plain words. If something isn't answered here, ask us.
Forge runs on Cloudflare's global network, and every connection to Forge is encrypted.
Card payments
Members enter their card on Stripe's secure checkout page, so card numbers never reach Forge.
Payments go to your gym's own Stripe account, and your members pay your gym directly. Forge keeps only the last four digits, so staff can tell which card is on file. Stripe's fees are listed on the pricing page.
Passwords and sign-in
Forge never stores passwords. It keeps only a salted, slow-to-crack fingerprint of each one (PBKDF2 with 100,000 rounds), so even we can't read them. Sign-in codes stop working after five wrong tries, and the sign-in cookie can't be read by scripts on the page.
Keeping each gym's data separate
Every piece of gym data in Forge is tagged with that gym's ID. Each time Forge reads or changes gym data, it has to say which gym it's for, and Forge blocks any request that doesn't. One gym can't see another gym's members.
Who can see member data
Only your gym's staff, and only what their role allows. You choose what each role can do, and you can change it for any one person.
Emails
Forge sends account emails, like sign-in codes and payment notices, through Resend.
Backups
Forge's database runs on Cloudflare, which keeps a restore history, so gym data can be rolled back to an earlier point in time if something goes wrong.
Testing before launch
Before the first gym goes live on Forge, it goes through two of our own security reviews and a test by an outside security firm.
This website
No ads, trackers, analytics, or cookies. Messages sent with the help center's contact form are stored with Cloudflare and delivered to our inbox through Microsoft. See the Privacy Policy.
Legal documents
Our Privacy Policy covers this website. The app's Terms of Service, privacy policy, and Data Processing Agreement are being drafted. See all legal documents.
Have a security question? Email us