Security

1. How document generation actually works

This is the highest-risk action on the platform, since it's the one place your personal details pass through our servers at all. The flow is the same for every AI-assisted tool, resume, cover letter, landlord letter, or court-form lookup:

• You type information into a form in your browser.
• It's sent over an encrypted HTTPS connection to our server.
• Our server forwards it to our AI provider (Google Gemini) solely to generate that one response.
• The result is returned to your browser and rendered there.
• Nothing from that request, your input or the generated output, is written to a database, a log file, or any other persistent storage on our side. It exists only in server memory for the duration of the request, then it's gone.

Closing the tab discards it from your side. Nothing further to discard on ours, because nothing was kept.

2. What we deliberately do not do

• No storage of document content, generated or typed in, at any point, on any server we control.
• No permanent case file or detailed personal history assembled about you. What free text does get stored is narrow and named: a milestone note you attach, a message or meeting note if you're in an org's coaching program, a support request you submit, and an optional private "this week" focus note only you can see. All of it is encrypted at rest with AES-256-GCM (authenticated encryption); the exact list and who can see each item is in Section 3 below.
• No ability for coaches, org admins, or Forzara staff to open, download, or view the content of anything you generate. That separation is enforced in the product itself: coach accounts have no code path that reads document content.
• No use of your data to train, fine-tune, or improve any AI model. Requests run on Gemini's paid API tier, which contractually excludes prompts and responses from training — Forzara does not process real participant or organization data on any tier that lacks this guarantee.
• No advertising, no behavioral profiling, no selling or renting personal information.

3. Who can see what

If you're enrolled through a partner organization, your assigned coach can see the status of your milestones (not started, pending, approved); any short optional note you choose to attach when submitting one; a note they themselves record during a review or follow-up meeting; and messages you exchange with them if you use Forzara's messaging feature. That's the entire visibility surface. They cannot see document content, or your optional personal focus notes described above, and there is no admin view, export, or support tool anywhere in the codebase that exposes either. Forzara staff can see account metadata (name, email, join date, organization membership) and the content of any support request you submit, for support purposes, and nothing more.

If we're ever served with a subpoena or court order for a specific account, the same list above is the ceiling of what exists to produce, plus organization membership and milestone status. We never produce document content, because none is ever stored to begin with — see our Privacy Policy for the full legal-process section, or our Proof of Absence page for a live query against the actual schema instead of another paragraph asserting it.

4. Infrastructure and technical controls

• Every connection is served over HTTPS, with HSTS enabled so a browser that has visited before won't even attempt a plain HTTP request the next time.
• Session cookies are marked Secure, HttpOnly, and SameSite=Lax, so they're never sent unencrypted, never readable by page JavaScript, and not attached to most cross-site requests.
• Passwords are hashed with PHP's password_hash() (bcrypt), never stored or logged in plain text, and checked against a database of known-breached passwords at signup and at every password change.
• A strict Content-Security-Policy with per-request nonces governs both scripts and styles. No inline script or style tag runs without the current request's nonce. The policy also sets X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Cross-Origin-Opener-Policy, and a locked-down Permissions-Policy that disables camera, microphone, geolocation, and other browser features the app never uses.
• Login and registration are rate-limited across multiple signals, not just a single IP address or account in isolation. Automated and abusive traffic patterns are detected and blocked. We don't publish the specifics.
• Every authenticated page is served with cache directives that keep participant data out of shared or disk browser caches.
• Two-factor login (SMS-based) is an opt-in feature any account holder, including staff and admin accounts, can turn on in Account Settings — it is not required or on by default for any role today. A hashed screen-lock PIN, separate from two-factor login, lets anyone quickly re-lock their own session on a shared device regardless of whether two-factor login is enabled.
• Forzara sets first-party cookies only: a session cookie, __Host- prefixed so the browser itself refuses to accept it unless it's Secure, host-only, and scoped to the whole site, on top of the HttpOnly and SameSite=Lax flags already on it; and, only while you're actively using the probation/parole correspondence tool, a short-lived draft-holding cookie with the same flags. No analytics, advertising, or third-party tracking cookies exist anywhere in the codebase. There's nothing to opt out of because nothing else is there.
• Free text that does get stored — milestone/meeting notes, messages, support requests, and the optional focus note — is encrypted at rest. Only the focus note auto-purges; the rest follows the retention rules in Section 6 of the Privacy Policy.
• Third-party code we vendor (like our HTML sanitizer) is checked against upstream security advisories and kept current, most recently a patch applied August 30, 2026.
• Independently verified, September 1, 2026: Qualys SSL Labs rates our TLS configuration A+, and the Mozilla HTTP Observatory scores our security headers A+ (130/100, 10/10 tests passed). Both are free, independent scans anyone can re-run against forzara.ai at those links.

5. Reporting a security issue

If you find something that looks like a security problem, a way to see data that shouldn't be visible, bypass a permission check, or anything else that doesn't match this page, we want to know before anyone else does.

For what we collect, retain, and delete, and your rights over your own account, see the Privacy Policy.