About your data

A platform designed for European clients

Forge is developed by a European company and complies with GDPR requirements as well as the security standards expected by European businesses. Our philosophy is clear:

• your data remains under your control;
• it is never resold;
• it is never used to train AI models.

Forge acts only on its clients' instructions, within a strict and auditable contractual framework.

Where is your data stored?

Primary hosting, France (EU)

Forge data is hosted in France by our main subcontractor Scaleway. This includes:

• personal data (users, identifiers, metadata);
• imported content (documents, videos, files, knowledge bases);
• indexes and representations required for search functionalities.

Data remains within Forge's infrastructure and is not transferred outside the European Union by default. Source: scaleway.com/fr/privacy.

Security and governance

The ISO 27001 certification is held by SQUARANCE (Rise Up) and covers the shared security processes used for Forge. This certification governs:

• access and authorization management;
• environment separation;
• action traceability;
• incident and risk management.

Security is integrated from the design stage and continuously monitored.

Observability and logs

Datadog

Forge uses Datadog for technical monitoring and incident detection. The processed data is limited to:

• technical metrics;
• application logs necessary for operations.

Logs contain no client content and no exploitable personal data. Retention is limited to what is strictly necessary for operational purposes. Source: datadoghq.com data processing agreement.

Use of artificial intelligence in Forge

Forge uses AI technologies to analyse your content and deliver its features. We rely on specialised subcontractors only when necessary.

Common principles for all AI providers

Regardless of the provider:

• only content data is transmitted, never full documents;
• Forge implements minimisation and pseudonymisation mechanisms to limit the presence of personal data in sent requests;
• data is not used to train models;
• data is not resold;
• retention is limited to technical needs of the service.

Data actually transmitted to AI providers

When Forge uses an AI provider, complete client content is never transmitted. AI providers receive no full documents, knowledge bases, or source files.

The transmitted data takes the form of a technical prompt, used to:

• answer a user's question;
• or generate a learning activity (e.g. flashcards, quiz, summary, podcast, guided activity).

This prompt may include:

• Forge coach instructions (role, tone, response rules);
• training programme context (learning objectives, structure, guidelines);
• text excerpts from the document search engine (RAG): up to 5 excerpts, each limited to 512 tokens;
• a recent conversation history: typically 5 to 10 messages, anonymised (no personal data, no user identifiers).

These data:

• are transmitted only to produce the requested response or activity;
• are not stored by Forge on provider systems;
• are retained by providers only temporarily, per their policies (security, abuse prevention, debugging).

Response reliability and hallucination mitigation

Forge implements several mechanisms to reduce the risk of AI errors or hallucinations, including:

• an internal control layer ("Judge") that checks response consistency with context and provided content;
• abuse and safety filters from AI providers;
• source citation when relevant, allowing users to identify the origin of information;
• a user feedback mechanism to report incorrect or inappropriate responses.

AI is used as an assistive tool, not as an autonomous source of truth. Responses are always contextualised using client-provided content.

AI subprocessors, provider details

The table below summarises each AI subprocessor used by Forge. Detailed processing notes follow.

GDPR and Forge's role

Forge acts as a data processor under the GDPR. We commit to:

• processing data only on behalf of our clients;
• ensuring confidentiality and security;
• assisting clients in meeting their regulatory obligations.

We apply strict security and confidentiality measures to guarantee you complete peace of mind.

For any questions: dpo@forgelearning.com.