Where your data goes,
and where it doesn't.
Agent Forge is a private, owner-only preview. This page describes the actual trust boundary the running system enforces — not a policy aspiration.
Browser → Cloudflare → container → storage → providers.
Cloudflare terminates the connection and proxies requests to a single on-demand container — it does not run your work itself. The container sleeps after eight idle hours without losing data in either storage layer below, and cold-starts on the next request.
Terminates TLS, proxies to the container, and is the only network path into the system. It does not store your prompts or output.
Sessions, projects, Karma routing evidence, decision traces, and ratings. Encrypted at rest by Atlas; access is scoped to the application's own credentials.
Uploaded files, generated artifacts, and Data Grid snapshots. The bucket has no public bucket domain — nothing in it is reachable by a direct URL.
Each provider you connect receives only the prompt for the request routed to it — not your session history, not your files, not requests routed elsewhere.
One account. Nothing public.
- Owner-only authentication; public signup is disabled at the application level, not just hidden in the UI
- Session cookies set
Secure,HttpOnly, andSameSite=Strict - A dedicated JWT signing key, distinct from any other credential
- An explicit allow-list of origins and hosts — requests from anywhere else are rejected
- The application's own login is the gate. Cloudflare Access is configured on these hostnames but its policies are deliberately set to bypass, so the edge does not add a second identity check — authentication is enforced in the application, and that is the boundary described above
- Self-serve signup — every account is provisioned by hand
- A public API surface — nothing here is meant to be called by strangers
- Any endpoint that returns another user's data, because there are no other users yet
Your provider keys stay yours.
Model provider API keys and authenticated GPU-runtime endpoints are stored with least-privilege scope and are never logged in full. Backups of the application's own state are encrypted and tested by restoring them, not just written and assumed good.
If something goes wrong.
The response process, in order: contain the affected runtime or provider · preserve redacted logs and trace identifiers · rotate any credential that may have been exposed · determine the affected data and time range · patch and re-run the production release checks · restore gradually while watching auth, errors, and provider health · record what changed to prevent a repeat.
Report a vulnerability →