Documentation

Enterprise SecurityGDPR & BDSG CompliantAWS KMS CMEKSHA-256 Hash ChainedFedRAMP High Ready

Data Sovereignty, CMEK & Tamper-Evident Ledger

For infrastructure megaprojects, defense contracts, and public sector developments, data residency is not optional—it is a strict statutory requirement. Forge provides multi-jurisdiction geographical isolation, Customer-Managed Encryption Keys (CMEK), and a cryptographically sealed SHA-256 audit ledger ensuring continuous mathematical non-repudiation.

Core Pillars of Sovereignty & Trust

Jurisdiction-Locked Data Residency

Project databases, pgvector document embeddings, and CPM execution nodes are anchored to specific sovereign legal boundaries. Choose from Frankfurt (EU GDPR/BDSG), London (Crown Commercial Ready), Dublin, US East/West (FedRAMP High), Zurich, or Sydney.

Customer-Managed Encryption Keys (CMEK)

Maintain total root-of-trust custody. Integrate your own AWS KMS Key ARN backed by FIPS 140-2 Level 3 Hardware Security Modules. If you revoke KMS key access, your project data is instantaneously crypto-shredded and completely inaccessible to anyone—including Forge.

Strict Cross-Border Egress Blocking

When dataResidencyStrict is enabled, all external integrations, cross-region replication, and analytics exports that attempt to transmit data beyond the jurisdiction boundary are blocked at the kernel network level, enforcing compliance with EU GDPR Chapter V (Articles 44–50).

SHA-256 Tamper-Evident Ledger

Every single project observation, schedule baseline update, evidence triage acceptance, and statutory notice is permanently chained using high-entropy SHA-256 block hashes (previousHash → currentHash). Any direct database alteration immediately breaks the mathematical chain.

Sovereign Data Regions & Legal Frameworks

Region	Identifier	Governing Legal Framework	Compliance Certifications
🇩🇪 Europe (Frankfurt)	EU_FRANKFURT	EU GDPR Art. 44–50, German Federal Data Protection Act (BDSG)	ISO 27001 SOC 2 Type II TISAX C5 (BSI)
🇬🇧 United Kingdom (London)	UK_LONDON	UK GDPR, Data Protection Act 2018 (Crown Commercial Service Ready)	Cyber Essentials Plus ISO 27001 SOC 2
🇮🇪 Europe (Dublin)	EU_IRELAND	EU GDPR Art. 44–50, Irish Data Protection Act 2018	ISO 27001 SOC 2 Type II
🇺🇸 US West (FedRAMP High)	US_WEST	FedRAMP High, ITAR (International Traffic in Arms Regulations), CJIS	FedRAMP High NIST SP 800-53 SOC 2
🇨🇭 Switzerland (Zurich)	CH_ZURICH	Swiss Federal Act on Data Protection (FADP / revDSG), FINMA RS 08/7	ISO 27001 FINMA Compliant
🇦🇺 Australia (Sydney)	AP_SYDNEY	Australian Privacy Principles (Privacy Act 1988), IRAP Protected	IRAP ISO 27001

Cryptographic Ledger Architecture

Every contractual dispute demands an unimpeachable audit trail. Forge structures all project actions as a deterministic cryptographic hash chain. Each record contains the SHA-256 digest of its contents plus the cryptographic hash of the preceding block:

Hash Chaining Formula

Block[N].hash = SHA256(Block[N-1].hash + ":" + environmentId + ":" + action + ":" + actorEmail + ":" + timestamp + ":" + SHA256(canonicalJson(payload)))

The Genesis block for each environment is initialized with 64 zero characters ("0".repeat(64)). Any retroactive mutation of an observation, constraint, or approval record irrevocably breaks all subsequent hashes in the chain.

REST API Reference

GET/api/compliance/residency

Retrieve active jurisdiction residency policy and CMEK status

PATCH/api/compliance/residency

Update jurisdiction, toggle strict egress locks, or configure AWS KMS ARN

GET/api/compliance/audit-trail

Query sequential hash-chained audit events with pagination

POST/api/compliance/audit-trail/verify

Recalculate complete SHA-256 chain from genesis block to verify zero tampering

GET/api/compliance/audit-trail/export

Export courtroom-certified cryptographic JSON audit package with verification digest

Ready to configure Data Sovereignty?

Follow our step-by-step administrator guide to set up CMEK and regional residency.

View Admin Setup Guide