Configuring Data Sovereignty & CMEK

As an Owner, navigate to Settings (/dashboard/settings) and locate the Data Sovereignty, CMEK & Audit Trail section.

Choose your project's geographical legal boundary from the jurisdiction selector:

Forge immediately displays the governing legal framework (e.g., EU GDPR Articles 44–50) and active compliance certifications for the chosen boundary.

Toggle Strict Cross-Border Data Residency to lock project assets into the chosen jurisdiction:

• Hard Egress Blocking: Blocks unauthorized cross-region outbound HTTP/gRPC data transmission.
• In-Region Vector Embeddings: Dedicated pgvector instance strictly located in your target region.
• Geographic Backups: Disaster recovery snapshots are cryptographically confined to compliant data centers within the specified territory.

To ensure zero vendor custody of your encryption keys:

1. In the AWS KMS Console, create a symmetric KMS Key in your designated AWS region.
2. Grant Forge's IAM Service Role permission to call kms:Encrypt, kms:Decrypt, and kms:GenerateDataKey.
3. In Forge, toggle Customer-Managed Keys (CMEK) and enter your AWS KMS Key ARN:arn:aws:kms:eu-central-1:123456789012:key/550e8400-e29b-41d4-a716-446655440000
4. Click Save Policy. Forge will verify KMS key connectivity and update the status indicator to ACTIVE.

All project modifications are linked via sequential SHA-256 block hashes. To verify mathematical ledger integrity:

Click Export Ledger (JSON) to download a timestamped, signed audit dossier containing all chronological events, actor emails, action payloads, and SHA-256 chain links for distribution to external dispute tribunals or compliance auditors.