Forge is preparing the requested surface and verifying the live route.
Forge is preparing the requested surface and verifying the live route.
An 8-stage security pipeline, enterprise authorization, and compliance-ready infrastructure protect every request.
Every request passes through eight security stages before, during, and after LLM processing.
SpiceDB (Zanzibar-style) permission checks combined with OPA + Rego policy evaluation. Sub-5ms authorization decisions before any request processing begins.
API key validation, rate limiting, and credential protection via Agent-Vault. Ensures all credentials are isolated and never exposed to downstream processors.
Multi-layer input analysis: LlamaFirewall (primary), DeBERTa-v3 semantic analysis, LLM Guard, Presidio PII detection, and PromptGuard 2 for injection prevention.
Guards against prompt injection through vector embeddings. Validates embedding integrity and prevents poisoned vector retrieval attacks.
Ensures requests are routed only to authorized providers with appropriate security classifications. Enforces data residency and compliance requirements.
Post-generation scanning of all LLM outputs for PII leakage, harmful content, and policy violations using LLM Guard and Presidio.
Adversarial probing with Augustus to continuously test defenses. Every request generates an audit trail for compliance and forensic analysis.
MCP tool scanning via mcp-scan. Validates tool provenance, checks for tampering, and enforces supply chain security for all MCP module calls.
Defense in depth from cloud infrastructure through authentication and authorization.
We are building toward comprehensive compliance certifications for regulated industries.
Point-in-time assessment of security controls. Target completion in 2026.
Ongoing effectiveness assessment over a 6-12 month observation period.
Business Associate Agreements available for Enterprise tier healthcare customers.
Compliance via Probo + EuConform integration for high-risk AI system requirements.
Full GDPR compliance including data subject rights, DPA, and data residency routing.
California Consumer Privacy Act compliance with opt-out and data deletion rights.
We take security vulnerabilities seriously. If you discover a security issue in Optima Forge, we ask that you disclose it responsibly so we can address it before it affects our users.
Our security.txt file is available at the standard well-known URI, following RFC 9116 for security vulnerability disclosure.
Contact: mailto:[email protected]
Expires: 2027-03-01T00:00:00.000Z
Preferred-Languages: en
Canonical: https://optimaforge.ai/.well-known/security.txt
Available at https://optimaforge.ai/.well-known/security.txt
For security inquiries, vulnerability reports, or to request our SOC 2 report, contact our security team directly.