Trust Center
Forge64 Trust Center
Last reviewed
Forge64 generates web apps from a prompt and hosts them. This Trust Center states, for security, architecture, scale, generation quality, data and payments, what the Forge64 code does today, what is implemented but still being switched on in production, and what is only planned. Where Forge64 has not measured something, such as traffic capacity or generation quality scores, the page says so and publishes no number.
What is in the Trust Center
- Forge64 security: How Forge64 isolates tenants, stores secrets, audits changes, backs up data and handles vulnerability reports. Every control is status-labelled.
- How a Forge64 app runs: How a Forge64 app is served: an edge control plane, a container per app on Forge64 Cloud, an isolated Postgres database, automatic TLS and caps.
- How Forge64 apps scale: How Forge64 apps scale, the limits on each plan, and how load tests are run. No traffic numbers are published because none have been measured yet.
- How Forge64 verifies generated apps: How Forge64 checks generated apps: a file gate, a static audit, bounded auto-repair and a benchmark method. No quality scores are published yet.
- Your data on Forge64: Who owns your app and data on Forge64, how to export it, what happens when you delete an app or account, and how GDPR erasure works.
- How sellers get paid on Forge64: How payments from an app's customers reach the seller with Forge Payments: who holds the money, refunds, disputes, fees and where sellers can be paid.
- Service status: live health of the API, builds, deploys, web app and database.
How to read the status labels
Every factual statement carries one of three labels. They are the same on every page. A statement without a label is not a claim about the product.
Summary: what is strong and what is not finished
This is the short, honest version for a buyer who has to decide whether to build on Forge64 today.
- BuiltEach app gets its own isolated Postgres database and its own database login roles, with the privileges that allow cross-tenant access removed.
- Rolling outTenant containers are firewalled from each other and from the host's admin ports, with per-app connection and bandwidth caps.
- Rolling outEncrypted off-server database backups with a tested restore drill.
- BuiltYou can export your app's source, database rows and metadata at any time, and delete your app or account.
- Rolling outSellers are paid directly through Forge Payments; Forge64 never holds seller funds.
- RoadmapPublished traffic benchmarks and a published generation-quality benchmark against other builders.
- RoadmapA third-party security certification such as SOC 2 or ISO 27001. Forge64 holds none today.
- RoadmapMulti-node hosting with failover. Production hosting is a single server today.
Forge64 compared with other AI app builders, on hosting and data facts
| Fact | Forge64 | Lovable | Bolt.new | Replit | Base44 |
|---|---|---|---|---|---|
| App hosting | Included. Containers on Forge64-operated servers; always-on slots on paid plans, and the Free plan's app sleeps when idle. | Included | Included (unverified source) | Partly: billed separately by usage | Included (unverified source) |
| Database | A dedicated Postgres database per app, in its own database with its own login roles. | Included in Lovable Cloud | Included (databases on Free and Pro) (unverified source) | Postgres billed by usage | Included (unverified source) |
| User sign-in | Built in. Sign-up, sign-in and user accounts, with no per-user fee. | Included in Lovable Cloud | Not confirmed on the pricing page (unverified source) | Replit Auth available; not confirmed on the pricing page | Included (unverified source) |
| Taking payments | Built in. Checkout and a billing page in the app. Recurring subscriptions sold by your app currently need your own payment-processor account. | Not confirmed on the pricing docs | Not confirmed on the pricing page (unverified source) | Not confirmed on the pricing page | Payments on Builder and above, per secondary sources (unverified source) |
| Paying out to sellers | Forge Payments. Built and tested in the processor's test mode; not yet switched on for live money. | Not confirmed on the pricing docs | Not confirmed on the pricing page (unverified source) | Not confirmed on the pricing page | Not confirmed on the pricing page (unverified source) |
| Export of source and data | Source, every version, database rows and metadata, with a manifest. Secret values are never exported. | Not assessed on this page | Not assessed on this page | Not assessed on this page | Not assessed on this page |
| Third-party security certification | None today. | Not assessed on this page | Not assessed on this page | Not assessed on this page | Not assessed on this page |
| Published traffic benchmarks | None. Being benchmarked. | Not assessed on this page | Not assessed on this page | Not assessed on this page | Not assessed on this page |
Competitor cells come from each vendor's public pricing pages, read on the review date; products change, so check the vendor's own pages before deciding. Forge64 has not assessed other vendors' security certifications, encryption or export features, and this table makes no claim about them.
Sources: Lovable: https://docs.lovable.dev/introduction/subscription-plans; Bolt.new (partly from secondary sources): https://bolt.new/pricing, https://www.activepieces.com/blog/boltnew-pricing-2026-plans-tokens-and-costs-explained; Replit: https://replit.com/pricing, https://docs.replit.com/billing/deployment-pricing, https://docs.replit.com/billing/about-usage-based-billing; Base44 (partly from secondary sources): https://base44.com/pricing, https://www.nocode.mba/articles/base44-pricing.
Report a vulnerability or ask a trust question
Security reports go to security@forge64.dev. The machine-readable disclosure file is at /.well-known/security.txt. Live service health is on the /status page.
Frequently asked questions
- Is Forge64 secure?
- Forge64 isolates each app with its own Postgres database and login roles, encrypts stored app secrets with AES-256-GCM, and records billing and project changes in a tamper-evident hash chain. Network isolation between tenant containers and encrypted off-server backups are implemented but still being switched on in production. Forge64 holds no third-party security certification today. Each control is listed with its status on the Security page.
- Does Forge64 have SOC 2 or ISO 27001?
- No. Forge64 holds no third-party security certification at the review date. A certification is on the Roadmap only in the sense that it is not done; no audit window or date is committed.
- Can I build a business on Forge64 today?
- Forge64 is in early access and sign-up is by invitation at the review date. You can export your app's source and database at any time, so you are not locked in. Production hosting is a single server, backups are being moved off the server, and traffic capacity has not been benchmarked, so plan accordingly for anything that needs high availability.
- How do I report a security vulnerability to Forge64?
- Email security@forge64.dev. The disclosure policy file is at /.well-known/security.txt. Forge64 does not promise a bug bounty.
- Where can I see whether Forge64 is up?
- The public status page is at /status. It reports API, build, deploy, web and database status, and shows 'unknown' rather than 'operational' when the monitoring service cannot be reached.
- What does the name Forge64 refer to?
- Forge64 is the AI app platform at forge64.dev. It is not Laravel Forge, Atlassian Forge, Minecraft Forge, the FORGE64 audio plugin or Forge64 Consulting AB.