- Encrypted in transit
- All data between your browser and Forecraft is encrypted with TLS 1.2 or higher (TLS 1.3 where your browser supports it), and HTTPS is enforced on every page with HSTS.
- Encrypted at rest
- Your client data is stored in databases encrypted with AES-256. Only Forecraft’s servers can query them. No third party can query your data directly. Documents added through Add documents are kept in a private file store that encrypts them at rest.
- No AI training
- Client financial data uploaded to Forecraft is never used to train AI models, by Anthropic, Forecraft or anyone else. It is used only to produce your close pack.
- Workspace isolation
- A user in one workspace cannot access data from another workspace, even within the same account. Access is checked on every request.
- Your data
- Every management pack you generate downloads as a standalone file. You can download your own records from Settings at any time, cancelled or not, and delete a workspace or your whole account yourself.
- Sign-in
- Two-factor authentication (TOTP) is available for every account, and workspace owners can require it for their whole team. Sessions end after 24 hours of inactivity, and you can sign out of every device at once.
Where your data lives
Forecraft runs on Vercel (hosting) and Neon (database), both in the United States. Database connections are encrypted, and only Forecraft’s application servers can reach the database. Stripe handles billing, so Forecraft never stores your card number or banking credentials.
A CSV or XLSX export you upload is read in your browser, and the file itself is not stored. The files added through Add documents (PDFs, decks, spreadsheets and photos of statements) are stored, so each figure can be checked against its page. They are kept in Vercel’s private file storage in the United States, which encrypts them at rest. No link opens them: Forecraft’s servers read a file back only after checking that the person asking belongs to the workspace.
Passwords are hashed with bcrypt (cost factor 12) before storage. OAuth tokens for the QuickBooks, Xero and Gusto connections are encrypted at rest.
How long we keep it
- Your account and its financial data are kept for as long as the account exists. Cancelling a paid plan moves you to the free Owner plan and deletes nothing.
- Deleting a workspace removes its packs, tasks, integrations and share links from the product at once and keeps them 7 days, so a mistake can be undone, then deletes them, along with any documents stored for it. Deleting your account removes it and every workspace you alone own at once, with their stored documents. Deleting one document deletes its stored file. Both are in Settings and ask you to confirm.
- The file of a document added through Add documents is deleted 12 months after it was added. A workspace owner can change that to 6, 12, 24 or 36 months in Settings. The figures confirmed from the document stay.
- Audit and security logs are deleted after 90 days, except the record of what each pack was sent with and what was agreed on it, which stays with the workspace.
- Expired share links and invitations are deleted 7 days after they expire.
The full list is in the privacy policy.
How we protect accounts
- Passwords must be at least 12 characters and are checked against known data breaches (without the password ever leaving our servers).
- After repeated failed sign-ins, the account locks for 15 minutes, and the network the attempts came from is blocked automatically.
- Every endpoint is rate-limited; abusive traffic is banned automatically and bans lift on their own.
- Changing your password or turning off 2FA signs you out on every device, and you get an email whenever it happens.
- Sign-in and password-reset links are single-use, expire quickly, and are stored only in hashed form.
- Admin tools require two-factor authentication.
- Client portal links can be revoked at any time; one-off share links expire after 30 days.
How Forecraft uses AI
Forecraft uses Anthropic’s Claude for two jobs: drafting the written commentary on a month’s close, and reading the documents added through Add documents. Anthropic’s commercial terms do not allow it to train models on what Forecraft sends, and Anthropic deletes API inputs and outputs within 30 days (longer only if a request is flagged for a usage-policy violation or the law requires it). AI is never used to make decisions about people. There is no chatbot.
For the commentary, this is what is sent. The model receives a summary of the close: revenue, expenses, net income and margins for the month and the comparison month, the five largest line-item movements, cash and runway, balance sheet ratios, data-quality notes, up to five recommendations, up to five open tasks, up to five lines of what happened this month that you marked for the client (never one marked internal), and the workspace’s industry and writing style. For the commentary, nothing else from your books is sent, and neither is the client company’s name or the names of the people tasks are assigned to. Labels from your books are cleaned first, and the model is told to ignore any instruction written inside them.
Every figure is calculated by Forecraft’s own code before the model is involved, and the model is told never to calculate or invent a number. Every amount and percentage in every part of its draft is then checked against the figures that were sent. That covers a number written with a currency sign, code or word, with a magnitude such as “1.2m”, or with thousands separators, and a number followed by “%” or “percent”. A plain number with none of those, such as a year, a count or a ratio like 1.8 or “1.8x”, and a number written as a word, is not checked. A sentence with a figure that does not match is replaced with a note asking you to verify it in the source data. The model runs at temperature 0, so drafting the same month twice gives text as close to the first as the model allows.
A document added through Add documents is sent to the model as the file you added, so it carries whatever the document carries, names included. The model returns the figures it finds, each with its page and how sure it is of it. Those are readings, and nothing is calculated from one until a person in the workspace has confirmed it beside the page. Nine-digit ID numbers, such as Social Security and employer ID numbers, are masked in what Forecraft keeps from the reading. The stored file itself is kept as you added it.
Forecraft can switch AI off for every account at once with one server setting, without changing code. While it is off, nothing is sent to Anthropic and the commentary is written from a template using the same figures. Documents can still be added and stored, and none of them is read.
A workspace owner can turn AI off for that workspace in Settings. After that, nothing from the workspace is sent to Anthropic, and the commentary comes from the same template. Documents added while it is off are stored and not read.
AI runs only when someone in the workspace presses “Draft the commentary” or adds a document through Add documents. Until then, and always on the free Owner plan, the commentary comes from that same template and nothing is sent to Anthropic. An AI draft stays out of the client’s pack until you tick “Use this narrative in the client’s pack”.
Found a security issue?
Email security@forecraft.tech with what you found and the steps to reproduce it, before you disclose it anywhere. We acknowledge every report within two business days, keep you updated while we fix it, and credit you if you’d like.
Test only against an account you created. We won’t take legal action against good-faith research that stays away from other customers’ data, doesn’t degrade the service, and doesn’t use social engineering. Our security.txt has the same contact in the standard format.
For general data questions, see our plain-English data guide, privacy policy and terms of service.
Last updated: November 6, 2026