Forged Raven PlatformTrust & transparency
Security & data access
How Forged Raven Platform handles access, payments, and operational information—and what this documentation does not establish.
Account and role access
Operational pages require sign-in. The CEO portal checks privileged access with the backend before displaying reports. Administrative roles are stored separately from user-editable profile information.
Company and record permissions
Company-scoped records use organization identifiers and database access policies. Record access depends on company membership and the policies for each feature. Privileged executive access has broader visibility; company membership alone should not be treated as a guarantee of need-to-know access.
Payments and customer links
Card payments use Stripe Checkout. Customers enter card details on Stripe, rather than in a Forged Raven form. Quote and survey links are public recipient links: protect them like private documents and avoid forwarding them to unintended recipients.
AI, reports, and activity records
Raven's signed-in assistant validates an account session. Service report generation can send selected notes, checklist results, and photos for AI processing. Review generated reports before saving or sharing them. QR scan activity records identify scans and their associated users; these are operational records, not an immutable forensic audit.
Security review scope
Automated scans and source-code checks are not a penetration test or a certification. This page does not claim SOC 2, ISO 27001, HIPAA compliance, a guaranteed recovery time, or a particular data-retention period.
Record-level authorization (BOLA/IDOR) and server-side outbound request safety (SSRF) require endpoint-by-endpoint testing. Organization filters, valid record IDs, or HTTPS-only URLs do not by themselves prove protection against these attacks. Complete independent coverage has not been established.
Raise a security concern
Contact the platform team with the affected page, approximate time, and a description of the concern. Do not include passwords, payment details, access tokens, or another customer's information.
Contact the platform team