Your books. In Quebec. Encrypted in transit and in backup.

Where your data sleeps

Your books and their backups stay on my server, in Quebec. Two exceptions, stated upfront. Cloudflare, a US company, carries the connections. And the Forgeron AI assistant, invoice reading, email sorting and body-shop photo analysis go through an AI provider based in the United States: I name it in my privacy policy, along with what each feature sends it. On request, I switch those features off for your business, except body-shop photo analysis, which does not follow that switch yet (it only sends when you start it). And if the software can't confirm that choice, it refuses to send: a refusal can be fixed, a leak can't.

What is encrypted, and how

• In transit: TLS 1.3 on the website and on the API, when tested on September 26, 2026. The website enforces HTTPS for two years (HSTS, max-age=63072000) and redirects every http:// address to https://.
• Sensitive fields: when you save an employee, their SIN and banking details (institution, transit, account) are encrypted one by one before being written to the database, with keys stored outside the database. Someone who copied the database would read "ftenc:" followed by a meaningless string of characters. Same treatment for the RAMQ number, allergies and medication in the patient file.
• Backups: every archive is encrypted with AES-256, file names included.
• Passwords: hashed with BCrypt, never stored in clear text. Even I can't read yours: I can only replace it with a temporary password.

Quebec Law 25: what the software does, point by point

• Portability: in the software, Settings → Backup / data export → "Télécharger sauvegarde JSON" (Download JSON backup). One single file with your customers, suppliers, products, invoices, quotes, purchase orders, journal entries, bank transactions, employees, pay stubs and fixed assets. JSON is an open format: you don't need me to read it back (employees' SIN and banking details stay encrypted in it).
• Erasure: you can ask for your account and your data to be deleted. Write to me at info@forge-tech.ca: I answer within the 30 days set by law. What the law requires to be kept is kept for the required period, then deleted; the privacy policy gives the periods.
• Audit log: the Audit log screen (Comptabilité → Journal d'audit) shows the last 500 creations, changes and deletions, with the user's email and the time. Module included from the Pro plan, or à la carte at $24.99/month. What it doesn't record yet is spelled out in this article (in French).
• My access to your data: every time I open your business's data from my admin console, the server records it, even when access is refused: the date, the account, the operation, the IP address and the response. That register exists for you: ask for it, and I'll send it.
• Incidents: if an incident presents a risk of serious injury, I promptly notify the Commission d'accès à l'information and the people affected (section 3.5 of Quebec's private-sector privacy act, added by Law 25). Every incident, even a minor one, goes into the register the law requires.
• Privacy officer: Guillaume Régimbald, Forge Tech, info@forge-tech.ca.

Sign-in and access

• Attempt cap: 5 wrong passwords in 15 minutes on the same account, and sign-in refuses further attempts for 15 minutes. 30 failures from the same IP address: same treatment. A successful sign-in resets your counter to zero.
• No free hints: an email address with no account gets the same refusal, in the same amount of time, as a wrong password. Trying addresses doesn't reveal who is a customer.
• Sessions: signed token (HMAC-SHA256), valid for 8 hours.
• Isolation: the business whose data you see is read from your signed token, never from the requested address. Changing an ID in a request doesn't open another business's data.

One database per business

Each customer business has its own PostgreSQL database. Your invoices don't share a table with another business's: a query can't "forget a filter" and show the neighbour's numbers, because the neighbour isn't in the same database. It takes more work to maintain, and that's deliberate.

Availability: the written commitment, and the live page

• 99.5% target, set by the Terms of Use; custom SLA for the Enterprise plan.
• Example: a 30-day month has 720 hours. 0.5% of 720 is 3.6 hours: the downtime margin that target leaves over a month. To compare with any promise, remember that each 0.1% is worth 43 minutes a month (720 × 0.001 = 0.72 h). Redo the math with another provider's number.
• Backups: every night at 3 a.m., every database goes into a single archive encrypted with AES-256, file names included. The archive is reopened and checked before the oldest ones are deleted: an unreadable copy never replaces a good one. I keep the last 14 nights, plus one copy per Sunday for 8 weeks.
• Read-back tested on August 10, 2026: two databases taken out of an archive and read back by pg_restore, the tool used to put them back into service (40 objects for one, 1,023 for the other). A backup nobody has ever reopened is an assumption.

What's still missing, I'll tell you straight: an off-site copy. For now, every backup sits on the same machine as the databases. When that's fixed, this sentence will change.

No 24/7 on-call: Forge Tech is one person. To know whether everything is running, you don't have to wait for me: the status page (in French) queries the servers live while you read it.

Two tests I don't control

Two public tools grade this website without asking my opinion: SecurityHeaders reads its security headers, SSL Labs tests its encryption. The links are just below. Run them again yourself, today or six months from now: the result doesn't go through me.

What about SOC 2?

Forge Tech has no SOC 2 report. That report is signed by an independent audit firm, and I haven't commissioned one. Instead of a badge, I show you what the software does: one database per business, passwords hashed with BCrypt, your employees' SIN encrypted before it is written, and the register of my access to your data from the admin console.

Report a vulnerability

Found a vulnerability? Email security@forge-tech.ca: the steps to reproduce it, what it allows, and a proof of concept if you have one. I reply within 48 hours, the delay written in this site's security.txt file. There is no reward program (bug bounty) for now.