Security and trust
Security, privacy and data handling at Foras
Project cost data is commercially sensitive. This page sets out how Foras handles access, change history and hosting today, and is deliberately explicit about what we do not claim.
How we work
Principles we hold to today.
Access is scoped to the organisation
Each customer organisation has its own users and project data. People see the projects they are given access to, and access is administered rather than assumed.
Changes are attributable
Commercially significant actions — reconciliation decisions, adjustments and baseline changes — record who made the change, when, and the reason given. The point of the product is explainability, so history is retained rather than overwritten.
Finance data is read, not rewritten
Finance actuals are imported for comparison. Foras does not post entries back into your ERP, and your accounting system remains the authoritative record of posted cost.
Your project data stays yours
Project and cost data belongs to the customer. We do not sell it, and we do not use customer project data to make claims in public marketing material.
Hosting and encryption
Foras is a hosted web application. Traffic is served over HTTPS and data is held with established cloud infrastructure providers rather than on self-managed hardware.
What we do not claim
No certifications are claimed at this stage.
Foras is an early-stage company. We hold no formal security certification today, and we will not imply one. If your procurement process requires evidence such as ISO 27001 or a completed security questionnaire, tell us early and we will be direct about what we can and cannot provide.
We also make no artificial-intelligence or predictive-analytics claims. Foras calculates a position and a forecast from data your teams enter and from Finance actuals you import.
Working with us
Raising a security question.
Security, hosting and data-handling questions from IT or procurement teams go to security@foras.one. If you believe you have found a vulnerability, please report it to the same address with enough detail for us to reproduce it, and give us a reasonable window to respond before disclosing it publicly.
How personal data is handled is set out in the Foras privacy notice.