Security & Data Handling

Most consultancies tell you they take security seriously and then ask you to send them your data. We've designed SignalForge so that, by default, you never have to. This page explains how we handle data, where it lives, and what we're accountable for.

Operating Principle

We don't reduce your data risk by adding controls on our side. We reduce it by removing ourselves from the data path entirely.

SignalForge builds AI-native GTM and operational systems inside your own infrastructure, using your own integrations. The systems we deploy are owned and operated by you. We don't host your data, we don't sit between you and your CRM, and we don't retain access after handover unless you explicitly contract us to.

This isn't a security feature we added. It's the operating model.

Two Engagement Models

Model 1 Client-hosted (default)

For most engagements, every system we build is deployed inside your own Base44 instance, connected to your own data sources (HubSpot, Notion, Google Drive, Slack/Teams, your conversational intelligence platform).

Under this model:

• Your data never leaves your infrastructure, and SignalForge never hosts it
• Where our build or support access involves personal data, SignalForge acts as processor to that limited extent, under a DPA provided at signature
• Access is scoped, granted by you, visible to you, and revocable at any time; at handover it is removed, or continues only under an agreed support retainer on the same terms
• You retain full ownership, full control, and the ability to evolve the system without us

Model 2 SignalForge-hosted (by exception)

Some clients and partners prefer not to operate their own Base44 instance. In these cases, we host the deployment on SignalForge's own Base44 infrastructure on the client's behalf.

Under this model:

• SignalForge acts as Processor under a signed Data Processing Agreement
• The client remains the Controller and determines purposes and means of processing
• All processing is governed by documented instructions in the DPA
• Sub-processors are disclosed in writing and require client acknowledgement
• The same security controls apply (see Infrastructure below)

This model is offered only where commercially appropriate and always under a DPA. Our standard DPA template is available on request.

Infrastructure

All SignalForge systems are built on Base44, our enterprise application platform. Whether the deployment runs in your Base44 instance or ours, the underlying security posture is the same.

Base44 provides:

• Enterprise-grade infrastructure (see Base44's published security documentation at base44.com/security)
• Encryption in transit (TLS 1.2+) and at rest (AES-256)
• Secrets management for API keys and credentials (least-privilege access)
• Role-based access controls
• Audit logging across application and data layers
• Data residency confirmed per deployment during the Architecture phase

Base44's full security documentation is available at base44.com/security.

We do not maintain our own servers, databases, or data lakes. SignalForge is deliberately a low-surface-area company.

Data Handling Commitments

Where SignalForge does process personal data either as Controller (our own business contacts, prospects, and team) or as Processor (under a client DPA) we commit to:

Sub-processors

The following sub-processors may process personal data in the course of our work, depending on the engagement:

For client-hosted deployments (Model 1), these sub-processors apply only to SignalForge's own business operations, not to client data. For SignalForge-hosted deployments (Model 2), the applicable sub-processors are listed in the DPA.

We notify affected clients in writing before adding or changing material sub-processors.

Compliance

• UK GDPR & Data Protection Act 2018 SignalForge Intelligence Ltd is registered with the Information Commissioner's Office
• ICO registration number: ZC134572
• SignalForge holds professional indemnity insurance of £1,000,000; certificate of insurance available on request
• Standard DPA available on request to any client or prospective client
• Companies House: SignalForge Intelligence Ltd

We do not currently hold ISO 27001 or SOC 2 certification ourselves. Where these standards are required, we rely on Base44's certified infrastructure and document the inheritance in our DPA.

What We Don't Do

To be explicit about what's not in scope:

• We do not provide 24/7 security monitoring of deployed systems
• We do not provide ongoing managed security services post-handover
• We do not provide penetration testing or formal security assessments
• We do not provide regulatory compliance advice (consult a qualified DPO or legal advisor)

These are deliberate choices. We're an AI-native systems consultancy, not a managed security provider.

Contact

For data protection, security, or compliance questions:

luke@signalforge.uk

For DPA requests, sub-processor disclosure, or to report a suspected security issue, the same address applies and is monitored during UK business hours.