MForja Privacy & Security Policies

Section 1

Our Core Commitment

MForja does not store, retain, or process client media, video, audio, or operational data. We collect only the contact and contracting information necessary to conduct business. Your content is yours — it does not pass through or reside on MForja infrastructure.

This policy applies to all visitors to mforja.com, individuals who submit contact or access request forms, and clients who engage MForja under a contractual relationship.

Section 2

What Data We Collect and Why

Data Category	Examples	Purpose	Stored?
Contact information	Name, work email, company, role	Waitlist management, early access communications	Yes
Contracting data	Business name, signatory, address, agreements	Legal and commercial relationship management	Yes
Website analytics	Page views, session data (anonymized), browser type	Site performance and content optimization	Aggregated only
Client media or video content	Video files, audio files, encoded streams	N/A — MForja does not receive, store, or process client content	Never
Pipeline or operational data	Encoding configurations, throughput metrics	N/A — not collected by MForja	Never

Section 3

How We Use Your Data

Data collected through mforja.com and direct communications is used solely for:

Responding to contact and access requests
Managing waitlist and early access program communications
Delivering technical briefings, demo invitations, and product updates to opted-in contacts
Executing and administering commercial agreements
Legal compliance and record-keeping obligations

MForja does not sell, rent, or license personal data to third parties for marketing or commercial purposes.

Section 4

Data Retention

Data Type	Retention Period	Basis
Waitlist and access request contacts	24 months from submission, or until opt-out	Legitimate interest / consent
Commercial contracts and agreements	7 years from contract end	Legal obligation (tax and commercial law)
Invoicing and payment records	7 years	Legal obligation
Website analytics	26 months (aggregated)	Legitimate interest
Support and inquiry correspondence	3 years	Legitimate interest

Section 5

Third-Party Services

MForja uses the following third-party services that may process limited personal data as part of standard web operations:

Cloudflare — Web performance, CDN, and security. May log IP addresses for security purposes per Cloudflare's own privacy policy.
Apollo.io — Website visitor identification for B2B sales intelligence. Operates under Apollo's privacy policy and applicable data protection law.
Google Analytics / Search Console — Aggregated website performance data. No personally identifiable information is processed.
Google Workspace — Form submissions and email communications. Data is processed under Google's data processing terms.

MForja does not transfer personal data to countries outside the EEA or UK without appropriate safeguards (Standard Contractual Clauses or adequacy decisions).

Section 6

Your Rights

Depending on your location, you may have the following rights regarding your personal data:

Right of access — Request a copy of the personal data we hold about you
Right to rectification — Request correction of inaccurate or incomplete data
Right to erasure — Request deletion of your personal data where no legal obligation to retain applies
Right to restriction — Request that we restrict processing of your data
Right to data portability — Receive your data in a structured, machine-readable format
Right to object — Object to processing based on legitimate interests
CCPA rights — California residents may request disclosure of categories of data collected, opt out of sale (we do not sell data), and request deletion

To exercise any of these rights, contact privacy@mforja.com. We will respond within 30 days.

Section 7

Cookies and Tracking

mforja.com uses minimal cookies necessary for site operation and analytics. We do not use third-party advertising cookies or behavioral tracking for ad targeting. Analytics data is aggregated and not tied to individual identities.

You may configure your browser to refuse cookies. Some site features may be affected, but core content remains accessible without cookies.

Section 8

Contact and Complaints

For all privacy-related inquiries: privacy@mforja.com

If you are located in the EU or UK and believe your data rights have been violated, you have the right to lodge a complaint with your local supervisory authority. In the UK, that is the Information Commissioner's Office (ICO). In the EU, contact your national data protection authority.

Section 9

Legal Basis for Processing

Where GDPR or equivalent legislation applies, MForja processes personal data on the following legal bases:

Processing Activity	Legal Basis
Responding to contact and access request submissions	Legitimate interests (responding to inbound inquiries)
Sending early access and product update communications	Consent (opt-in at point of submission)
Executing and administering contracts	Contract performance
Retaining financial and legal records	Legal obligation
Operating and improving our website	Legitimate interests (service operation and security)
B2B visitor identification via Apollo.io	Legitimate interests (sales and marketing to business contacts)

Where processing is based on consent, you have the right to withdraw that consent at any time by contacting privacy@mforja.com. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Section 10

International Data Transfers

MForja is based in the United States. If you are located in the European Economic Area (EEA), the United Kingdom, or another jurisdiction with data transfer restrictions, your personal data may be transferred to and processed in the United States or other countries that may not provide the same level of data protection as your home jurisdiction.

When transferring personal data from the EEA or UK to countries not covered by an adequacy decision, MForja relies on the following transfer mechanisms:

Standard Contractual Clauses (SCCs) — EU Commission-approved SCCs are incorporated into agreements with service providers that process EEA personal data
UK International Data Transfer Agreements (IDTAs) — Used for transfers from the UK where applicable
Adequacy decisions — Where the European Commission or UK government has determined that a destination country provides adequate protection, transfers proceed under that determination

A copy of applicable transfer safeguards is available upon request by contacting privacy@mforja.com.

Section 11

Children's Privacy

MForja's products and services are designed for enterprise and professional use. We do not knowingly collect, solicit, or retain personal data from individuals under the age of 16 (or under 13 in jurisdictions where COPPA applies).

Our website and contact forms are not directed at children, and we do not have reason to believe that children access our services. If we become aware that we have inadvertently collected personal data from a child under the applicable age threshold, we will delete it promptly. If you believe we have collected data from a child, please contact privacy@mforja.com immediately.

Section 12

Changes to This Policy

MForja reviews this Data Privacy Policy at least annually and may update it to reflect changes in our data practices, applicable law, or regulatory guidance. When we make material changes, we will:

Update the "Last updated" date at the top of this page
Post the revised policy at mforja.com/policies.html
Where required by law or where changes are significant, notify affected individuals directly by email

We encourage you to review this policy periodically. Continued use of our website or services following notice of changes constitutes acceptance of the updated policy. If you do not agree with a material change, please discontinue use and contact us to exercise any applicable rights.

Previous versions of this policy are available upon request.

Section 1

Security Posture and Principles

MForja applies a defense-in-depth security framework grounded in Zero Trust principles, least-privilege access control, and continuous monitoring. Security is embedded into product development, infrastructure operations, and business processes — not applied as an afterthought.

Key principle: MForja does not receive, store, or process client media or video content. This architectural decision eliminates the largest class of data security risk for our clients.

Zero Trust architecture — no implicit trust based on network location
Least-privilege access — all access rights scoped to minimum necessary
Defense in depth — multiple independent security controls at each layer
Continuous monitoring — automated threat detection and anomaly alerting
Security-by-design — security requirements built into the development lifecycle

Section 2

Access Control

Multi-factor authentication (MFA) required for all internal systems and infrastructure access
Role-Based Access Control (RBAC) enforced across all systems — access tied to business need, not seniority
Just-In-Time (JIT) access for privileged operations — elevated access is temporary and audit-logged
All access privileges reviewed quarterly and upon role changes
Offboarding triggers system access revocation within 24 hours
External vendor and partner access governed by formal access agreements with scope limitations

Section 3

Data Encryption

Data at rest: AES-256 encryption for all stored data, including contact and contracting records
Data in transit: TLS 1.2 minimum enforced for all external communications; TLS 1.3 preferred
Key management: Encryption keys managed separately from encrypted data, with rotation schedules enforced
Email: Secure email protocols enforced for all business communications

Section 4

Infrastructure Security

Cloud infrastructure deployed in compliance with provider security best practices (CIS Benchmarks)
Network segmentation enforced — internal systems not exposed to public internet without explicit justification
Automated vulnerability scanning on all internet-facing assets
Patch management policy: critical patches applied within 24 hours of availability; high severity within 7 days
Web Application Firewall (WAF) deployed on all public-facing endpoints via Cloudflare
DDoS protection active at the edge layer

Section 5

Incident Response

MForja maintains a formal incident response plan reviewed annually. In the event of a confirmed security incident involving personal data:

Internal containment and assessment initiated within 1 hour of detection
Affected parties notified within 72 hours where required by applicable law (GDPR Article 33/34, CCPA)
Post-incident review and control improvement completed within 30 days
Incident logs retained for a minimum of 3 years

To report a suspected security incident: security@mforja.com

Section 6

Responsible Disclosure

MForja welcomes good-faith security research. If you discover a potential vulnerability in MForja's systems or website, please report it to security@mforja.com before public disclosure.

We commit to acknowledging all reports within 5 business days, working collaboratively on remediation, and not pursuing legal action against researchers who follow responsible disclosure principles.

Out-of-scope: social engineering attacks on MForja personnel, physical security testing, or testing of third-party services used by MForja.

Section 7

Compliance Framework

NIST CSF 2.0 — Primary security framework guiding control design and governance
GDPR — Data protection compliance for EU/EEA data subjects
CCPA — Privacy rights compliance for California residents
SOC 2 Type II — Compliance roadmap in progress
ISO 27001 — Information security management standard; alignment in progress

Section 8

Security Inquiries

For security-related inquiries, vulnerability reports, or requests for security documentation as part of vendor assessment:

security@mforja.com

Section 9

Third-Party and Vendor Security

MForja applies security requirements to all third-party vendors and service providers that access, process, or store data on our behalf. Our vendor security program includes:

Security assessment prior to onboarding new vendors with access to systems or data
Contractual data processing agreements (DPAs) with all vendors handling personal data, including Standard Contractual Clauses where applicable
Vendor access scoped to minimum necessary — no standing administrative access granted to third parties
Annual review of critical vendors' security posture, including review of SOC 2 reports, ISO 27001 certificates, or equivalent attestations where available
Offboarding procedures for vendors, including credential revocation and data deletion confirmation
Sub-processor disclosures maintained and updated in accordance with applicable data protection law

Current third-party services processing data on behalf of MForja include Cloudflare (CDN/WAF), Google Workspace (communications), and Apollo.io (B2B visitor identification). Each is assessed for security and privacy compliance prior to and during engagement.

Section 10

Security Awareness and Training

MForja maintains a security-aware culture through structured training and ongoing education programs:

Security awareness training required for all personnel upon onboarding and annually thereafter
Training covers phishing recognition, social engineering, secure credential practices, data handling, and incident reporting procedures
Simulated phishing exercises conducted periodically to reinforce awareness and measure training effectiveness
Role-specific security training for personnel with elevated access or responsibility for sensitive systems
Security policies reviewed with all personnel at least annually; acknowledgment documented
Clear escalation path for reporting suspected incidents or policy violations without fear of reprisal

Section 11

Business Continuity and Disaster Recovery

MForja maintains documented business continuity and disaster recovery (BC/DR) plans to ensure operational resilience and data availability in the event of system failure, natural disaster, or other disruptive event:

Critical data backed up at defined intervals with backups stored in geographically separate locations
Backup integrity verified through periodic restoration testing
Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO) defined for critical systems and reviewed annually
BC/DR plans reviewed and tested at least annually; findings incorporated into plan updates
Key personnel identified for incident response and recovery coordination, with documented alternates
Communication plan maintained for notifying clients, partners, and regulators in the event of a service-affecting incident

Section 12

Physical Security and Device Management

MForja enforces physical security and endpoint device controls to protect against unauthorized access and data loss:

Device encryption: Full-disk encryption required on all company and BYOD devices used to access MForja systems
Screen lock: Automatic screen lock enforced after a maximum of 5 minutes of inactivity on all devices
Mobile device management (MDM): Enrolled devices subject to remote wipe capability in the event of loss or theft
Clean desk policy: Sensitive information not left unattended in physical workspaces; paper records containing personal data stored securely and disposed of by secure shredding
Visitor management: Visitors to facilities escorted by personnel and never granted unsupervised access to areas containing systems or sensitive information
Lost or stolen devices: Reported immediately to security@mforja.com; remote wipe initiated within 1 hour of confirmed loss

As a distributed, software-first organization, MForja's physical security posture is designed for a remote-work environment with cloud-native infrastructure. Physical access to data centers is governed by MForja's cloud infrastructure providers (AWS, Google Cloud, or equivalent), whose physical security controls are independently audited and certifiable to SOC 2, ISO 27001, and relevant standards.