# Security and privacy

> Signing in, your password and devices, changing your email, deleting your account, and how Forge looks after your data.

This page covers the security settings you control, and a summary of how Forge looks after your data. The full statements are our [Security page](https://forge.page/security), [Privacy Policy](https://forge.page/privacy) and [Data Processing Agreement](https://forge.page/dpa).

## Signing in

You can sign in with **Google**, or with your **email and a password**.

- A password must be at least 12 characters. Longer is better. A passphrase beats a puzzle.
- If you sign up with email, you confirm your address from a link we send. The link works for 24 hours.
- Forgotten your password? Choose **Forgot password?** on the sign-in page. The reset link lasts an hour, and resetting signs you out everywhere.

Forge does not have two-step verification of its own yet. If you sign in with Google, your Google account's own two-step verification protects that sign-in.

## Your password and devices

Open **Settings → Security**.

- **Password**: change it here. Changing it signs you out of your other devices unless you tick **Keep me signed in on my other devices**. If you sign in with Google, there is no Forge password to change.
- **Where you're signed in**: every device with an active session, and when it was last used. Sessions last 30 days. Choose **Sign out** beside anything you do not recognise, or **Sign out everywhere else**.

## Change your email address

1. Open **Settings → Profile** and find **Your email**.
2. Choose **Change email**, enter the new address, and choose **Send the link**.
3. Open the link we send to the new address.

Your email changes when you open that link, not before. The old address is told about the change.

## Delete your account

Open **Settings → Profile** and find **Delete your account**. You confirm by typing your account's email address.

Deleting your account:

- removes your booking page, bookings, clients, invoices, proposals, uploads and calendar connections;
- cancels any Forge subscription;
- withdraws Forge's access to your Google Calendar.

It happens straight away and can't be undone. Backups are kept for 30 days and then gone for good.

Two things to know first:

- If you take payments through Forge, your Stripe account stays open so money in transit still reaches you. Close it from Stripe once it has paid out, or email us and we will.
- If you own a team, you can't delete your account while you do. Email support@forge.page.

## Get a copy of your data

- **Reports** has CSV exports of your bookings, invoices, leads, clients and companies. Reports is part of the paid plans.
- Any board can be exported with **Export as CSV**.
- For a copy of everything we hold about you, email support@forge.page and we will put one together. There is no self-serve button for this yet.

## How Forge protects your data

- Everything is encrypted in transit and at rest.
- Calendar access tokens are encrypted a second time by us before they are stored.
- We never store passwords, only salted hashes.
- Our database and servers run in London.
- Public links to bookings, invoices, proposals and portals use long, unguessable addresses and are kept out of search engines.
- Sign-in, booking and every other public form is rate-limited.
- We do not sell data, show ads, or run tracking or session-recording tools. Forge does not use tracking, analytics or advertising cookies.

## Your calendar data

When you connect a calendar, Forge stores a copy of your events so it can show them and keep your availability right.

Forge's use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements. We do not use calendar data for advertising, we do not sell it, and we do not pass it to our AI features. See [What Forge's AI does, and what it never sees](https://docs.forge.page/ai).

Disconnecting a calendar removes its synced events from Forge. Events on your real calendar are not touched.

## Who else handles your data

The companies that help us run Forge, and what each one does, are listed in the [Privacy Policy](https://forge.page/privacy). We give 14 days' notice before adding a new one.

Forge is operated by Waelas Ltd, a company registered in England and Wales.

## Report a security problem

If you think you have found a security problem, email support@forge.page with the subject "Security report". Include what you found, where, and the steps to reproduce it. We reply within three working days.

---

Source: https://docs.forge.page/security-and-privacy