Trust

Trust, shown as evidence.

This page is the single place to understand how forwardslash.ch protects your data: what we operate today, the documents you can take to your security team, and the controls behind each claim. Everything here is versioned, dated and reviewed — a claim without a date does not publish.

Last reviewed 2026-07-01 · security@forwardslash.ch · View service status

Posture snapshot — the short version.

Data residencyPostgres in EU (Frankfurt)Operating

EncryptionTLS 1.2+ in transit · encrypted at restOperating

Outbound sendingDry-run by default · daily cap · approvalOperating

AuthorisationServer-side on every API routeOperating

SOC 2 Type IIReadiness programme underwayIn progress

Restricted

Data access level — staff access is role-scoped, time-boxed and logged

Primary data region (Frankfurt) — contracted, not aspirational

200 / day

Default hard cap on real sends — raised deliberately, never silently

100%

Support impersonation sessions logged and visible to the workspace

What we comply with, and what we are working toward.

OperatingGDPREU processing under the DPA and EU SCCs; data-subject rights served from the product (export, deletion, retention classes).Reviewed 2026-07-01

OperatingSwiss revFADPSwiss addendum in the DPA; the same residency, retention and access controls apply.Reviewed 2026-07-01

OperatingDPA + EU SCCsVersioned DPA with EU Standard Contractual Clauses, downloadable from the document library.Reviewed 2026-07-01

OperatingEU data residencyPrimary Postgres in Frankfurt; the deployment region is contracted, not aspirational.Reviewed 2026-07-01

In progressSOC 2 Type IIReadiness programme underway: all 27 controls mapped to the Trust Services Criteria, with the risk-assessment (CC3) and control-review (CC4) gaps closed; auditor selection next. Milestones appear in the updates feed.Reviewed 2026-09-02

PlannedISO 27001Scoping follows the SOC 2 observation window, reusing the same controls inventory.Reviewed 2026-07-01

Take these to your security team.

Data processing agreement

Version 2026-08-draft

Retention

5 data classes

Penetration-test executive summary

Executive summary of the most recent external penetration test, with remediation status. Shared under NDA.

Request under NDA →

Security questionnaire pack

Standing CAIQ-style answers generated from the controls inventory and reviewed by a person. Shared under NDA.

Request under NDA →

Insurance certificate

Current certificate of insurance. Shared under NDA.

Request under NDA →

Written policy pack (incl. AI use note)

Access management, acceptable use, incident response and the AI use note — what models, what data they see, the human-approval rule, the no-training clause. Shared under NDA; the AI note is also published at /trust/ai.

Request under NDA →

Security questionnaire pack

Standing CAIQ-style answers generated from the controls inventory and reviewed by a person. Shared under NDA.

Request under NDA →

Security questionnaire pack

Standing CAIQ-style answers generated from the controls inventory and reviewed by a person. Shared under NDA.

Request under NDA →

The controls behind the claims.

Data security

Access control

Infrastructure security

4 controls

Organisational security

6 controls

4 controls

Availability

3 controls

Security

31 measures, plainly described

Who touches customer data, and why.

Subprocessors

5 named providers

Changes, announced before they happen.

2026-09-03

SOC 2 CC4 gap closed: independent control-review cadence defined

Quarterly independent review of control operation (the reviewer is never the implementer, outcomes are recorded, and failures are tracked to a fix) is defined as a control and mapped to CC4. This closes the CC4 gap; review outcomes will be announced here.

2026-09-03

SOC 2 CC3 gap closed: periodic risk assessment defined

The organisation-wide risk assessment process (product, data, vendors, AI; at least every six months and after material changes) is defined as a control in the inventory and mapped to CC3. This closes the CC3 gap; the first cycle is tied to the SOC 2 observation window and will be announced here.

2026-09-02

SOC 2 readiness: controls mapped to the Trust Services Criteria

All 27 inventory controls are mapped across CC1–CC9, Availability and Confidentiality, and the mapping is checked automatically in both directions. Two gaps are open: a formal periodic risk assessment (CC3) and an independent control-review cadence (CC4). Next milestone: auditor selection and the observation window.

2026-07-01

Subprocessor list reviewed

Annual review of the five subprocessors completed. No additions, no removals. Subscribers are notified before any new subprocessor is engaged.

2026-07-01

Trust Centre published

The single anchored trust centre replaces the plain content pages: posture snapshot, compliance statuses, document library with the NDA request flow, controls inventory and this feed.

Asked by every security review.

Where is our data stored?: The production database runs in Neon's EU (Frankfurt) region. Providers that span EU/US are listed with their role in the subprocessor list, and email delivery routing is stated in the DPA.; See: subprocessors →
Can we get our data out?: Yes, at any time and on any plan. Structured export of records, history and files is a product feature, not a negotiation. At contract end, data is deleted or returned on the published retention schedule.; See: Product security →
Who at forwardslash.ch can see our data?: Access is role-scoped, time-boxed and least-privilege. Support access to a workspace is logged and visible to that workspace — you can see every impersonation session.; See: Access control →
How is AI used with our data?: AI features draft, classify and propose; they do not act unattended. Consequential actions remain attributable to a person and reviewable before execution. AI providers used, if any, appear in the subprocessor list like any other provider, and no customer content trains a model.; See: AI →
Do you have SOC 2 / ISO 27001?: Not yet, and we will not imply otherwise with a look-alike badge. A SOC 2 Type II readiness programme is underway and ISO 27001 is scoped to follow it; progress is posted in Updates. Meanwhile, each claim links to the control behind it.; See: compliance →
How do we report a vulnerability?: Email security@forwardslash.ch. We acknowledge within two business days, keep you informed through remediation, and credit reporters who wish to be named. Good-faith research within the disclosure policy will not be met with legal action.; See: Written policy pack (incl. AI use note) →

Trust, shown as evidence.

Last reviewed 2026-07-01 · security@forwardslash.ch · View service status

What we comply with, and what we are working toward.

OperatingGDPREU processing under the DPA and EU SCCs; data-subject rights served from the product (export, deletion, retention classes).Reviewed 2026-07-01

OperatingSwiss revFADPSwiss addendum in the DPA; the same residency, retention and access controls apply.Reviewed 2026-07-01

OperatingDPA + EU SCCsVersioned DPA with EU Standard Contractual Clauses, downloadable from the document library.Reviewed 2026-07-01

OperatingEU data residencyPrimary Postgres in Frankfurt; the deployment region is contracted, not aspirational.Reviewed 2026-07-01

PlannedISO 27001Scoping follows the SOC 2 observation window, reusing the same controls inventory.Reviewed 2026-07-01

Take these to your security team.

Penetration-test executive summary

Executive summary of the most recent external penetration test, with remediation status. Shared under NDA.

Request under NDA →

Security questionnaire pack

Standing CAIQ-style answers generated from the controls inventory and reviewed by a person. Shared under NDA.

Request under NDA →

Insurance certificate

Current certificate of insurance. Shared under NDA.

Request under NDA →

Written policy pack (incl. AI use note)

Request under NDA →

Security questionnaire pack

Standing CAIQ-style answers generated from the controls inventory and reviewed by a person. Shared under NDA.

Request under NDA →

Security questionnaire pack

Standing CAIQ-style answers generated from the controls inventory and reviewed by a person. Shared under NDA.

Request under NDA →

Changes, announced before they happen.

2026-09-03

SOC 2 CC4 gap closed: independent control-review cadence defined

2026-09-03

SOC 2 CC3 gap closed: periodic risk assessment defined

2026-09-02

SOC 2 readiness: controls mapped to the Trust Services Criteria

2026-07-01

Subprocessor list reviewed

Annual review of the five subprocessors completed. No additions, no removals. Subscribers are notified before any new subprocessor is engaged.

2026-07-01

Trust Centre published

The single anchored trust centre replaces the plain content pages: posture snapshot, compliance statuses, document library with the NDA request flow, controls inventory and this feed.

Asked by every security review.

Where is our data stored?

The production database runs in Neon's EU (Frankfurt) region. Providers that span EU/US are listed with their role in the subprocessor list, and email delivery routing is stated in the DPA.

See: subprocessors →

Can we get our data out?

Yes, at any time and on any plan. Structured export of records, history and files is a product feature, not a negotiation. At contract end, data is deleted or returned on the published retention schedule.

See: Product security →

Who at forwardslash.ch can see our data?

Access is role-scoped, time-boxed and least-privilege. Support access to a workspace is logged and visible to that workspace — you can see every impersonation session.

See: Access control →

How is AI used with our data?

AI features draft, classify and propose; they do not act unattended. Consequential actions remain attributable to a person and reviewable before execution. AI providers used, if any, appear in the subprocessor list like any other provider, and no customer content trains a model.

See: AI →

Do you have SOC 2 / ISO 27001?

Not yet, and we will not imply otherwise with a look-alike badge. A SOC 2 Type II readiness programme is underway and ISO 27001 is scoped to follow it; progress is posted in Updates. Meanwhile, each claim links to the control behind it.

See: compliance →

How do we report a vulnerability?

Email security@forwardslash.ch. We acknowledge within two business days, keep you informed through remediation, and credit reporters who wish to be named. Good-faith research within the disclosure policy will not be met with legal action.

See: Written policy pack (incl. AI use note) →