Security and data

Where the data sits

The database and uploaded files are on servers in Frankfurt, Germany. Some services come from US companies, such as email delivery, error tracking and website hosting. Data we send them is covered by the EU Standard Contractual Clauses. See who they are

Who else works with the data

Currently 8 processors. For each one we list what it does and where it is based. See the list

Encryption

Every connection to the site, the shops and the admin is encrypted (HTTPS). We do not store passwords, only a cryptographic hash that cannot be turned back into the password.

Backups

We back up the database every day. Backups are encrypted and stored outside the provider that runs the database. We keep daily backups for 30 days and the first backup of each month for 90 days.

Disaster recovery

We have a written recovery procedure. The goal is to have the service back within 4 hours, losing at most the last 24 hours of data.

Who on our side can reach the data

Only people who need it to run the service, and they are bound by confidentiality. Our administrator accounts require two-factor authentication. Sign-ins, admin actions and data exports go into an audit log we keep for 24 months.

If there is a data breach

We notify you without undue delay, as the data processing agreement requires (Art. 8.2). We also send you the details you need to report it to the authority within 72 hours.

Data processing agreement

Current version: 4. Read it

Export and deletion

On every plan, including the free one.

Audit log

From Pro upwards.

Single sign-on

From Business upwards.

Two-factor authentication

You can turn it on for any account, on every plan. It is mandatory for shop admins and production staff.

We report outages publicly, hosted outside our own infrastructure. Service status

Found a security issue? Email us at support@forgmatic.com

Need something that is not here? Write to us