Trust and security
Named sources. Your rules. Every send on the record.
Every company comes from a named source: an official public business register, read at the source, or the built-in global B2B database our data partner supplies, named in Annex B. We run no scraper against a network behind a login, and we do not log in to or crawl a social network. People come from three accountable places: a provider named in Annex B, licensed under contract, which warrants its own lawful basis; decision-makers found in public search results, including public professional profiles those results return; and our founder's own professional network export. What a partner uploads, a member's own connections export included, is that partner's own record, in its own workspace. All four source categories are named in the Article 14 notice, which governs. Kvasir drafts. Today you approve every send. Autopilot is coming: an admin will be able to let workers send follow-ups inside your rules.
Last reviewed 8 October 2026
01 · Where the companies come from
Every source is named.
Each market's public business register, read under its own terms, and the built-in global B2B database our data partner supplies, named in Annex B.
Full provenance is available on request. Every attribute we hold traces to one of the categories named in the notice and to the named source behind it. The register-level detail comes in writing, under the data processing agreement. Ask at privacy@forgeby.com and you get it.
Bolagsverket · SCB · Brønnøysund · PRH · Companies House · read at the source · under each register's own terms · aggregate bands only on public pages · provenance per attribute on request
02 · The hard rules
Four things we do not do.
03 · The lawful channel
The market decides the channel.
Marketing law differs by country. The product applies each market's lawful contact channel for you.
Suppression before a draft exists.
Where a market publishes an objection or advertising-protection register, it is applied at the source. A company or person on one is screened out before anything is written.
The rule travels with the record.
Every record carries the lawful way in for its market before anything is drafted. The rule is applied in the product, not published.
Documented, and balanced.
Business contact data of a person in a professional role is processed on documented legitimate interest, balanced and written down, for business-to-business contact only. We process what the role needs and nothing beyond it.
How to say no.
Where business contact details were obtained from somewhere other than the person, the source categories and the route to object are set out in the privacy policy, with the article-level basis. An objection stops the processing.
04 · The sign-in line
Person data lives behind sign-in. Always.
There is one line on this product and it does not move. Before sign-in, counts. After sign-in, inside your own isolated workspace, the work. Sign-up is by invitation. A company mailbox is the door; free mail addresses are refused. Your CRM, mailbox and apps come in only when you connect them.
- How many companies are in a market
- How the cloud posture splits, as bands
- How many decision roles sit on a company, as a count
- Which next step an account already has on the desk
- The account-level read
- Named roles and business contact details
- Drafts, approvals and the send from your own inbox
- Your own records, isolated from every other partner's
- Privacy notice
Workspaces are separated by row-level security in the database itself. An unauthenticated caller holds no database privileges: the public surface reaches a few read-only aggregate endpoints and nothing else. No partner can see another partner's records.
05 · Kvasir and the cast
Kvasir drafts. Your rules decide what sends.
Kvasir and the cast are openly AI and say so on every surface. They work inside the rules your admin sets.
Risk tiers
Every tool has a risk tier. The higher the tier, the more has to be true first.
Each tool Kvasir uses is sorted into one of three tiers. You can see the tier on every tool at forgeby.com/tools.
The tiers follow the thinking behind the EU AI Act, which asks for more care where an AI system can do more harm: the more a system can act on its own, the more oversight, record-keeping and ways to stop it are needed. Our design is aligned with that thinking. We do not claim certification or legal compliance with the Act. It describes how we build, and the binding terms are in your agreement.
06 · Where it lives
Where it lives. Every exception named.
Your workspace, your records and the library are stored in Stockholm (eu-north-1). Some services run in the United States under Standard Contractual Clauses: sign-in (WorkOS), web search (Serper), connected apps (Composio) and the AI fallback (Anthropic). Annex B says what each one receives. Reasoning runs in the EU by default, on Amazon Bedrock EU inference profiles, within EU regions. Data is encrypted in transit with TLS 1.2 or better and at rest with AES-256. Secrets stay server-side, never handed to a browser.
One caveat, stated plainly: some inference runs outside the EU under Standard Contractual Clauses. That covers live web search, which the EU region does not offer, streamed responses, which our EU integration does not yet support, and fallback when the EU route is unavailable. No customer records are stored there. Every processor is named and versioned in the data processing agreement and sub-processor list, and that list is the authoritative one.
Kvasir does not speak aloud today. No voice-synthesis service receives anything, and none is named in Annex B. Records reach only the services named in Annex B, and only as each row says.
Meeting capture runs only after a seller switches listening on, and never without consent recorded. Its processing region is not pinned yet. Annex B says so.
Google favicon service: receives a company's website domain from our server, to draw its logo. Never a person, never who looked.
07 · Objection and erasure
The route, in plain words.
If you want out, one email does it.
Write and say what you want: access to what we hold, a correction, an objection to the processing, or erasure. We answer within one month, as the law requires, and sooner in practice.
An erasure is a suppression as well as a delete. The record is removed and the identifier is held on a suppression list so the next load of the register does not quietly bring it back. That is the only thing that survives an erasure.
For a security issue, give us reasonable time to fix it before public disclosure. We will tell you what we found and when it was closed.
Site visitors
Companies that read your site. Never people.
A seller can add one line to its own site, forgeby.com/v.js, and learn which companies read it. Here is all it does.
- The script sets no cookie, stores nothing in the browser and reads nothing about the device. It sends the page (never the query string), a site key and the time. Never the referrer.
- Do Not Track and Global Privacy Control stop it. With consent mode on, the default for sites in the EU, it sends nothing until the visitor says yes.
- We use the visitor's network address once, in memory, to find its network block and look up, in public internet registry data, which organisation holds it; registries only ever see the block. Our code keeps no copy of the address. Like any website, our hosting provider processes the connection to deliver the request, under its data processing agreement with us.
- Only an organisation's own network is matched, and only to a company in our own library with a known headcount of at least 10. Home broadband, mobile networks, VPNs, cloud hosts, public wifi, sole traders and companies of unknown size resolve to nothing.
- We keep the company, the pages and the hour of the visit for 90 days. Nothing finer than the hour, and no person.
- Careers and jobs pages never count, a seller's own staff are left out, and anything on a seller's never-list is never filed.
- Any organisation can ask to be left out of every seller's list at forgeby.com/visitors/opt-out. A link goes to a role mailbox at its domain, and only that link leaves it out; then what was filed for it is deleted.
This feature is in review with counsel before launch. This entry changes on the day it does.
08 · What we do not claim
GDPR-aligned. Not ISO certified.
Forgeby is a Swedish company built to GDPR. The proof is not a seal, it is the machinery, and every piece is public:
- Every sub-processor named in Annex B, with its region and its date.
- The Article 14 notice, in plain language, with an absolute one-email opt-out.
- Your rights answered in 14 days, half the month the law allows (privacy).
- National suppression registers honoured in the data itself: reklamspärr, NIX, reklamebeskyttelse.
- No scraper of ours runs against a network behind a login, and we do not log in to or crawl a social network. Person data comes from a provider named in Annex B, licensed under contract; from public search results, including public professional profiles those results return; or from our founder's own professional network export. We can tell any person which of the four categories their record came from.
- The data processing agreement and its full sub-processor table, published.
- Nothing sold, no ad trackers, and no consent banner because nothing consent-gated loads (cookies).
ISO 27001 is on the roadmap and we are not certified today. We do not claim certifications we have not earned. This page changes on the day that does.
The fastest way to judge this is to try it on your own accounts. Start free.
Start freeThis page describes our posture in good faith. It is not a contract. The binding terms are in your agreement and in the data processing agreement.