How this website is run, how we handle data inside client engagements, and what we deliberately do not do.
Last updated 13 August 2026.
forgefunction.online is a static site. There is no database, no user accounts, no login and no session state — so there is no store of visitor data to breach.
It is hosted on Vercel and served over HTTPS with certificates managed automatically. The deployment domain is excluded from search indexing so only the primary domain is public.
Webfonts are self-hosted rather than pulled from a CDN, so viewing a page makes no third-party request and leaks no visitor IP addresses to anyone else.
Authorisation is enforced in the database rather than only in application code. Row-level security restricts each tenant and role to its own rows, as in Layers and Saloo.live, and departmental RBAC isolates what each agent may read, as in the IOP AI platform.
The principle is that a bug in the interface should not be able to expose data the viewer was never entitled to.
Credentials live in environment configuration, never in source control. Where we are given access to client infrastructure we ask for the narrowest scope that does the job, and we ask you to revoke or rotate that access once the engagement ends.
Where a system uses a language model, we ground it in your data rather than letting it generate facts. Vendor details, prices and figures are served from the database and passed through as data, so the model writes the language but never the numbers.
Where a task can be solved deterministically we prefer that to a model, which removes the data-exposure question entirely. DIP Engine and the Tea Packaging optimiser both replaced model calls with exact computation for this reason.
We retain nothing after handover. Once a system is delivered, the source, infrastructure and data are yours, and we keep no copy of your data, database dumps or credentials.
Backup and recovery are designed as part of each system's architecture and run inside your own infrastructure, so restoring never depends on us still holding something.
Where you have your own cloud accounts we build in them, so the data never leaves your control. Where we stand infrastructure up during a build, ownership transfers to you on delivery along with the documentation needed to run it.
We hold no compliance certifications — no SOC 2, no ISO 27001, no formal audit. If your procurement process requires them, tell us early and we will say honestly whether we can meet it rather than waste your time.
We are an independent studio, not a managed security provider. What is described here is engineering practice, not a certified control framework.
If you believe you have found a vulnerability in this website or in something we built for you, email us and we will respond directly. Please give us a reasonable window to fix it before disclosing publicly.
Forge & Function — Independent studio, operated personally by its founder. Shubham Mandal, Founder & Principal Engineer. Raipur, Chhattisgarh, India. Contact: shubhammandal00e@gmail.com.