Security

ForgeMuse is built by a small team in beta, so we will not pretend to be a bank. What we can do is keep the amount of data we hold small, keep the architecture simple, and be straight with you about both. This page explains how the Service is put together from a security point of view, and how to reach us if you find a hole in it.

The architecture works in your favour

The most important security property of ForgeMuse is structural: your work does not live on our servers.

• the desktop app runs on your machine, and your projects and code stay there;
• the agents run against your own Claude subscription through Claude Code, so your prompts and your model traffic flow between you and your provider, not through us;
• we do not store your prompts, your sessions or your code, and we never use them to train anything;
• what our servers do hold is deliberately boring: your account email, beta signup emails, release metadata and subscription state.

Accounts and sign-in

Sign-in for the app is handled by WorkOS AuthKit, a dedicated authentication provider. We do not store passwords for user accounts. Desktop sessions use scoped API tokens that you can revoke by signing out.

Payments

Payments are processed by Stripe, a PCI DSS Level 1 certified processor. Card numbers go directly to Stripe; they never touch our servers, and we could not see them if we wanted to.

In transit and at rest

All traffic between you and forgemuse.net is encrypted with TLS. The little data we do store is kept encrypted at rest, access to it is limited to the people who operate the Service, and server logs are short-lived (see the Privacy Policy for retention periods).

No trackers in the audience

The Site sets no advertising or analytics cookies, loads no third-party trackers and serves its fonts from our own servers. Less data collected is less data to protect.

Downloads

Download the ForgeMuse desktop app only from forgemuse.net or from links we send to your registered email. We do not distribute the app through third-party download portals; anything you find there is not ours.

Reporting a vulnerability

If you believe you have found a security issue in the Site, the desktop app or our infrastructure, please tell us at [email protected]. Include enough detail for us to reproduce the issue, and give us a reasonable window to fix it before you disclose it publicly. In return:

• we will acknowledge your report promptly and keep you informed as we fix it;
• we will not take legal action against good-faith research that respects user data and does not disrupt the Service;
• we will credit you for the find if you want the credit.

Please do not run automated scanners against production, access data that is not yours, or test denial of service. If you need a test account for research, ask us.

Questions

Anything about security that this page does not answer? Email [email protected].