Request access

Trust and security

Locked, wiped, on the record.

What happens to your jobs and data inside the forge, where it lives, who can reach it, and what we do not have yet. The detail behind each point is in the docs.

Isolation

One job per GPU

  • Each job runs in its own rootless container under the NVIDIA runtime, with no host mounts and no host network.
  • GPUs are never shared between jobs: no MIG slicing, no time slicing.
  • Multi GPU jobs stay on one NVLink fabric; nothing is placed beside them.

Security in the docs

Data lifecycle

Wiped at the end of every job

  • Scratch is a per job encrypted volume; its key is destroyed when the job ends.
  • GPU memory is cleared, and host memory zeroed, before the next job is placed.
  • Deletion on request, backups included, completes within 7 days.

Storage and mounts

Residency

Your data stays in the EEA

  • Compute and storage are in Reykjanes, Iceland. Iceland is in the European Economic Area and GDPR applies.
  • Nightly snapshots go to a second building on the same campus, not abroad.
  • We do not read your data, sell it, or train on it.
Access

Keys with scopes

  • API keys are scoped read, run or admin, hashed at rest and shown once.
  • Rotation keeps the old key valid for 15 minutes so running scripts can switch.
  • Every call is logged with key and request id, visible to team owners for 90 days.

API reference

Transport

Encrypted on the wire

  • TLS 1.3 for the API, console, job endpoints and heat feed.
  • Shell sessions go through our SSH gateway with your key.
  • Job endpoints are private to your API key unless you mark them public.
Facility

A building you cannot walk into

  • Badge and biometric entry, cameras on every aisle, staff on site around the clock.
  • A and B power feeds from separate breakers to every node.
  • Drives that leave the building are shredded on site first.

Forge F1

Availability

Incidents in public

  • Live state on the status page; every incident and maintenance window in the incident log.
  • Anvil nodes carry a 99.7 % monthly availability commitment, with credits applied by themselves.
  • Maintenance is announced 7 days ahead, at most once a month and at most 3 hours.

Service levels

Compliance

Where we stand, plainly

  • We do not hold SOC 2 or ISO 27001 yet. We will say so here the day that changes.
  • We sign a data processing agreement on request and answer security questionnaires in writing.
  • Ask for either in a work order.

Responsible disclosure

Found a hole? Tell us first.

  • Send it through the work order form with security as the first word of the notes.
  • We acknowledge within one business day and keep you posted until it is fixed.
  • We do not take action against good faith research that avoids privacy violations and service disruption.
  • Our contact details for researchers are also at /.well-known/security.txt.
In scope
  • This website and its forms
  • The API, console and heat feed
  • Job isolation on F1

Subprocessors

Who else touches data.

ServiceWhat forWhere
VercelHosts this website and counts page views without cookiesGlobal edge network
SupabaseStores work orders sent from the request access formEU region
ResendDelivers work order notification emails to our teamEmail delivery

None of them see your jobs or the data inside the forge. They handle the website and the work order form only.

Need it in writing?

Ask for our data processing agreement or security questionnaire answers in a work order. A person replies within one business day.

Write a work order