Security

How Forumulate is built to hold your documentation, your community and your customers' data. We operate the whole of it; there is nothing for you to run.

Where your data lives

One PostgreSQL database, with every tenant-owned table under row-level security the database enforces — not the application. The API connects as a restricted role and opens each request inside a transaction that states which organization it is for; a query that forgets to scope itself returns nothing rather than somebody else's rows. A test fails the build if a table carrying an organization is added without a policy.

Sign-in

Staff sign-in runs entirely through Atlas, our own identity service. Since 15 September 2026 it is the only way in: Forumulate's own password, session and second-factor code was removed, and the credential material lives in Atlas. Passwords are stored as hashes and never in the clear.

Two-factor authentication, passkeys, SAML and OIDC single sign-on, and SCIM directory provisioning are configured per organization, and an organization can require SSO for its domain, which closes password sign-in for everyone in it.

Readers are a separate pool from staff. A space's owner chooses how readers sign in — a password you hold, your own provider, or none at all.

In the browser

Reader pages carry a Content-Security-Policy that names what may run: a per-response nonce with strict-dynamic for script, named lists for fonts, stylesheets and embeds, and the API origins a reference documents rather than "anywhere on the web". Trusted Types is enforced on top, so the address a script is loaded from is checked at the sink rather than only in a header.

External pictures in documentation are fetched by us and served from your own origin, so the host an author linked from no longer learns the IP and user agent of every reader of your documentation.

Tokens and access

Permissions are a capability set, resolved per organization and per space with deny-always-wins. Personal access tokens can be narrowed to specific scopes, capabilities and spaces, and every token is stored as a hash. The API publishes its own contract at /api/openapi.json, and what a token may reach is listed at /api/pats/scopes.

Payments

Card numbers never reach us. Our payment processor handles them.

Backups

The database is dumped daily and kept on a rolling schedule. Deleted content leaves the public web immediately and ages out of backups afterwards.

Reporting something

Write to the address published in security.txt (RFC 9116). If you need a signed DPA or the subprocessor list as a document, the same address reaches us.

What we will tell you

If something goes wrong on a surface you depend on, it appears on the status page and, when it changed how the product behaves, in the changelog.