Security

The short version

• We are a small company. One person holds administrative access to our systems.
• Every product is sold as a one-off purchase. There are no user accounts on the product sites, and no passwords for us to lose.
• Card details are entered on Stripe's own checkout page and never reach our servers.
• We hold no security certification of our own. Several of the companies that process data for us do, and each is listed below with a link to its own published statement.
• We do not sell personal information, and we do not share it for advertising.

What data we hold

Only what a purchase needs. For a typical order that is your email address, what you bought, and whatever you typed into the product so it could produce your result — a website address, a brand name, a description, a file you uploaded to the products that accept one. Plus the result itself, and ordinary server logs.

Our products are built for business and public inputs. Please do not send us government identifiers, health records, account credentials, or anyone else's confidential material. The privacy policy sets this out in full.

Connections in transit

Every Jobbot site is served over HTTPS only. A plain HTTP request is redirected to HTTPS, and every response carries a strict-transport-security header with a two-year lifetime, so a browser that has seen one of our pages will refuse to use plain HTTP for it afterwards. Traffic between us and the companies listed below runs over their HTTPS APIs.

Where data is stored, and how it is reached

Order records and the files we generate are stored in Vercel's object storage. Accounts and usage records for our API service are stored in a Neon Postgres database. Both providers hold the data in their own managed, encrypted storage; we do not add a second layer of encryption on top of theirs. Processing happens in the United States and in the other regions where these providers operate.

Access to your order and to the file we generate for you is controlled by an unguessable identifier in the link we email you. Anyone holding that link can open it, so treat it the way you would treat any private link. If you need one revoked, email hello@forage.bot.

Payments

Payment is handled entirely by Stripe. You enter your card details on a page hosted by Stripe, not by us; our code contains no card-entry component and never receives a card number. Stripe tells us that a payment succeeded, along with your email address and what you bought. For some products the details you submitted are attached to the payment record, so the order can be fulfilled once payment clears.

How AI models are used

Most of our products generate their result with an AI model. We reach those models through OpenRouter, which passes the request on to the company that runs the model. What you submit is sent as written, because it is the input the result is built from.

OpenRouter states that it does not train on what you submit and does not retain prompts unless prompt logging is switched on, and it publishes a table of each model provider's own retention and training practices. Both are linked from its entry below.

What we cannot tell you is how any individual model provider handles what it receives. We do not restrict routing to the providers with the strictest retention settings, so a request may reach one that retains it. We make no promise on their behalf. If you would not want a third party to process something, do not submit it.

Who can get to your data

Administrative access to our infrastructure is held by one person. Our internal operations dashboard is protected by a passkey, so signing in requires a hardware-backed credential rather than a password. The companies listed below have access to the data described against each one.

One of them passes data further on. OpenRouter forwards what you submit to whichever company runs the model serving your request, so those model providers receive it too. They are not a fixed list we can publish, because the model a product uses can change; OpenRouter publishes the current set, and each provider's retention and training practices, at openrouter.ai/providers. Apart from those model providers, no company outside the list below receives your data.

Subprocessors

These are the companies that process data on our behalf. Each entry says what we use the company for and what it can actually see, taken from the code that calls it rather than from what the category usually implies. Where a company publishes an independent security report, the link goes to the company's own page saying so; where we could not find one, the entry says that instead of leaving it out.

Services you connect yourself

A few products can connect to a service you already use — for example, one product reads issues from your Linear workspace using a key you supply and posts a summary to a Slack channel you nominate. Those connections exist only when you set them up, carry only what that product needs, and stop when you remove the key. They are your services rather than ours, so they are not in the list above.

Search engines

We submit the addresses of our own public marketing pages to search engines so they can be found. Only public page addresses are sent. No customer data is involved, and we run no advertising or analytics trackers on our sites.

Keeping and deleting data

We keep order and billing records for as long as tax and accounting rules require. Everything else is kept while it is needed to deliver and support your order. The privacy policy sets out the categories.

You can ask us to delete your data by emailing hello@forage.bot. Be aware that we do this by hand today — there is no self-service button and no automated process behind it, so we do not publish a turnaround time. We will tell you when it is done. Records we are required to keep for tax purposes are anonymised rather than removed.

Reporting a security problem

Email hello@forage.bot with "security" in the subject line. Please include enough detail to reproduce the problem. We read every message and will reply, though we do not offer a guaranteed response time and we do not pay for reports. Please do not access, alter, or retain anyone else's data while investigating.

If something goes wrong that affects your data, we will tell you where the law requires it and where it is the right thing to do.

What we do not have

A security page that lists only strengths is not much use for making a decision. These are the gaps we know about as of August 16, 2026. Each is a real limitation, not a formality.

• No security certification of our own. We hold no SOC 2 report and no ISO 27001 certificate, and we are not currently undergoing an audit for either. If your procurement process requires one, we are not a fit yet.
• No record of who accessed what. We do not keep an internal log of administrative access to systems or customer records. If a credential of ours were misused, we could not tell you afterwards exactly what was reached.
• No verified restore of order records. Order records live in our provider's storage. We have not performed and verified a restore, so we cannot promise recovery from accidental deletion or corruption.
• No automated deletion. Deletion requests are handled manually, as described above.
• No independent testing. Nobody outside the company has tested our systems for vulnerabilities, and we run no bug bounty.
• No published availability target. We do not measure or commit to an uptime figure. Live status for each product is at status.forage.bot.
• No formal security programme. There is no written incident-response plan, no scheduled risk review, and no security training programme — there are no employees to train.

We are working through several of these. We have deliberately not described any of them here as planned or in progress, because a plan is not a protection.

Questions we get asked

If you send a standard security questionnaire, this section covers most of what they ask. We will complete a questionnaire on request; we do not keep a pre-filled one on file.

• Do you have a DPA? We do not publish a standard data processing agreement. If you need one, email us.
• Do you use subprocessors outside the US? Yes. Migadu is a Swiss company and states that it stores mail in France. The rest are listed above with links to their own terms.
• Do you train AI models on our data? We do not. We cannot make that promise on behalf of the model providers our requests reach through OpenRouter, which is why the section above says not to submit anything you would not want processed by a third party.
• Is data encrypted? In transit, yes — HTTPS everywhere. At rest, it sits in our providers' managed encrypted storage; we add nothing on top of that.
• Can we get a copy of our data? Yes. Email us and we will send what we hold.
• How do you notify us of changes here? The date at the top of this page changes. We do not maintain a notification list.