The security review, answered before you asked.

Forge is a desktop application for Windows that organizes and works on files in folders you choose. You point it at one folder. A person types or talks to it, and it reads and writes plain files there — trackers, planners, notes, the tools of somebody's day. The AI part: when a person asks it to do something, the words needed for the answer go to an AI model provider, named below, and the answer comes back.

That's the whole shape. The rest of this page is the detail, including the parts that don't flatter me.

Your files live on your machine and never touch my infrastructure. The app makes exactly three kinds of calls to me, and here they are, field by field — so you can diff this list against a packet capture and decide how much to trust the rest of the page.

That is the complete list. And the negatives, since they're the point:

• No file contents, no chat contents, nothing you build ever goes to me. The complete inventory of what my systems hold about a seat: activation code, purchase email, seat status, and whatever a person typed into the bug box.
• No analytics, no crash reporting, no telemetry — there's no analytics software in the app to send any. The app's interface is locked down by a content-security policy that blocks it from making network calls at all; every call above comes from a short, enumerated list in the app's core.
• The agent engine's own telemetry and error reporting are switched off on every launch.
• The app writes a local log of agent activity into your own folder, as plain text, never uploaded. It's your audit trail, not mine.
• Voice never leaves the machine. Speech is transcribed locally; the speech model downloads once, the first time the mic is used, and after that the audio stays home.

The words a person sends the agent — and the contents of files the agent reads to answer — go to an AI model provider. That's the product working, and you should know exactly who sits in that path rather than find out from a packet capture.

The included, metered lane (the default): requests go from the machine through OpenRouter, a commercial AI routing service, under a capped key issued for that seat, to the models named right here. The current lineup: Anthropic’s Claude (Sonnet class), which handles everything — words and images both. If that lineup ever changes — a different brain, or a specialist model for one narrow job, the way image-reading once needed its own — this page changes the same day, and any model that ever touches your content is listed here by name. I have the zero-data-retention setting enabled for that routing — that is OpenRouter's documented policy, and I relay it rather than attest it; it's their commitment, not something a one-person shop can independently audit. What my side can see is the gas meter: usage as dollar totals — how much, never what. I cannot read prompts, files, or outputs.

Prefer no middleman at all? Run Forge on your own Claude subscription. Flip a switch in settings and sign in with your own Anthropic login: every conversation then runs directly between the machine and Anthropic, under the agreement you already have with them. Nothing routes through OpenRouter, and nothing — not even the meter — passes through me. If your organization already has an AI policy that covers Claude, this lane adds no new data relationship to review.

The agent works inside one folder you choose — its world. Everything it builds and edits lands there as plain files you can open in Notepad. Any action outside that folder — touching another file, going out to the web, running a command that leaves the fence — stops and shows a permission card stating exactly what it wants to do, and a human clicks Allow or Deny.

Nothing runs unattended. No scheduled jobs, no background autonomy — every session is a person at the keyboard. And because everything the agent does lands as plain text, the folder itself is the audit trail: readable, searchable, yours.

The app updates itself. At launch and every six hours it checks a public release feed on GitHub, downloads any newer installer in the background, verifies the Windows code signature against the publisher — CHANGE THE WORLD, LLC — and applies it on the next quit. The swap is atomic and fail-safe: if the download is incomplete, the signature doesn't match, or anything else is off, nothing is applied and the running copy is untouched. Updates never touch your files, your folder, or your activation.

If your shop pins versions: set the environment variable FORGE_DISABLE_SELFUPDATE (any value, machine-wide) and self-update is off entirely. You then deploy the versioned installers from the public releases feed on your own schedule — that's full version pinning, and it works today. The honest edges: there's no in-app update setting, no deferral window, and no release channels. The switch is the environment variable.

I'm one person, and a fair review asks what happens if I disappear. Here's the honest layout.

What fails open: a working seat doesn't depend on my infrastructure being up. On the metered lane, agent turns never route through my activation service — an outage on my end can't interrupt a working seat; the only thing it can delay is a first-time activation. On the own-sign-in lane, the app carries roughly a fourteen-day grace window on its membership check; past that, new agent turns pause until a check succeeds, and everything already built keeps working.

What you keep no matter what: every machine Forge ever built for you is plain files on your own computers — readable forever, in any text editor, with no proprietary format and no vendor database behind it. The AI supply is the model provider, not me. Billing for seats stops when seats stop.

The honest residual: the app itself — updates, fixes, activation — is maintained by one person. If I stop, it stops being maintained. The failure mode is "we keep everything we built and go back to doing it by hand," not "our data is stranded." Size the bet accordingly.

I don't have a SOC 2, and I won't pretend one is coming this quarter. Here's why the audit is smaller than usual anyway: most of what a SOC 2 attests is a vendor's cloud — the access controls and encryption around servers that hold customer data. Forge holds no customer data. Your files are never in my cloud, so there's no cloud of mine to audit. Audit the architecture instead; it fits on one page, and this is the page.

The offer that goes with it: put Forge on a test box and watch what it sends. It's an endpoint app — the wire tells the truth, and it should match the list above exactly.

The residual, stated plainly: there's no third-party attestation of anything here — no penetration test, no SBOM, no auditor's letter. What you get is an architecture you can verify yourself. If a formal attestation is a hard gate in your shop, I'm the wrong vendor today.

An agent that reads whatever lands in a folder can be fed a malicious document carrying instructions meant for it. That's prompt injection, and nobody in the industry has solved it — including the largest vendors. Anyone claiming immunity is selling something.

What Forge does about it is structural. The dangerous version of this attack needs an unsupervised way out — a channel where the agent can move data somewhere without a human noticing. Forge amputates that leg: a poisoned file can at worst confuse output inside the world folder, where it's plain text and reviewable; any action that could actually move data out — a network call, a write outside the folder, a command — throws a permission card a human has to approve, and nothing runs unattended. The attack goes from zero-click to needing one bad click on a card the person wasn't expecting.

That's a real narrowing, not an immunity. The residual: the human is the control, and humans do click through dialogs. There's no injection-detection layer and no output filtering here, and I won't imply either.

No central admin plane. There's no fleet policy console, no org-wide enforcement of which AI lane seats use or where world folders may point, no exportable audit log beyond the plain files themselves, and seat administration is manual. At a handful of seats that's a spreadsheet; at hundreds it's a real gap. If you need a fleet-control story, this product doesn't have one — I'd rather you read that here than discover it in a rollout.

The complete list of companies involved in running Forge, and what each one handles:

• Stripe — payments. Their checkout, their vault; card details never touch my systems.
• OpenRouter — AI routing on the included metered lane. Carries the conversation traffic for that lane, with the zero-data-retention setting on (their policy, linked above).
• Anthropic — the AI models. Receives the words needed for answers — through OpenRouter on the metered lane, or directly under your own agreement on your own sign-in. The app also downloads its agent engine once from Anthropic's release server, checksum-verified.
• GitHub — hosts the public update feed, the installers, and the one-time local speech-model download.
• Resend — transactional email: the note that delivers an activation code.

That's the whole list. No analytics vendor, no ad network, no data broker, nothing else. (The website you're reading is covered separately, on the privacy page.)

Questions, questionnaires, or anything this page didn't cover: [email protected]. That's me — there's no support tier between you and the person who built it, which cuts both ways, and the honest accounting of that trade is everything you just read.