RevForge connects customers, jobs, calls, crews, prices, margin, collections, cash, and business value. Trust cannot be a lock icon or a vague promise. The owner needs explicit data ownership, isolation, authority boundaries, revocable access, and a traceable record of every automated action.
The platform can only improve the whole business if the owner can trust the boundaries around the whole business. These controls define ownership, access, action, isolation, and accountability.
Access controls, audit logging, change management, and production security practices are designed around SOC 2 standards. RevForge is not certified yet. Certification is in progress, and the current status can be reviewed directly with the team.
Current state: standards implemented · certification in progressYour customers, jobs, prices, crews, calls, margin, cash, and outcomes belong to your business. RevForge does not sell that data and does not hand raw business data to an outside party to train on. You can export it or close the account.
Owner data · exportable · never soldData is encrypted in transit and at rest. Access follows least-privilege principles and is logged. Automated actions are recorded in an append-only audit trail the business can review.
Encrypted · least privilege · loggedEvery business is isolated from every other. Raw tenant data is not pooled across shops. A business can choose to participate in anonymized benchmarks, but those benchmarks do not expose another contractor’s underlying data.
Per-business isolation · benchmark opt-inRev can watch, recommend, prepare, or execute by decision and domain. Higher-impact moves can require approval. Authority can be reduced at any time, and the owner can use the master switch to stop automated action.
Decision-level authority · approval gates · master switchWhen RevForge connects to an outside service, it requests only the access needed for that job. Access is scoped and revocable. Inbound connections are signature-verified and gated by consent.
Minimum scope · revocable access · verified inbound trafficSecurity is also defined by the lines a platform refuses to cross. These promises are not hidden in a settings page or left for the owner to infer.
Customer, job, financial, operating, and outcome data does not become a resale product.
The contractor’s private operating history is not handed to an outside party to train on.
Businesses remain isolated. Any anonymized benchmark participation is optional and does not expose raw tenant data.
Every action is limited by domain, decision, confidence, price, margin, spend, and other owner-defined rules.
RevForge is built to SOC 2 standards, but it is not certified yet. Certification is in progress.
The owner can export the business data or close the account; the operating history goes with the business.
RevForge does not treat connected access as unlimited permission. Evidence is scoped, owner authority is checked, outside access is minimized, and automated action remains reviewable after it runs.
Only the signals and records needed to understand the decision are brought into context.
Source stays attachedThe decision is matched against the configured domain, action level, limits, confidence, and approval rules.
Boundary checked before actionWhere an outside service is needed, access stays scoped to the work and can be revoked.
Scoped and revocableAutomated action is written to the append-only audit trail so the owner can see what moved and why.
Action remains traceableBuilding a security review, evaluating access, or checking a specific workflow? Ask for the current SOC 2 progress, data-flow details, authority model, isolation approach, or connection scope. RevForge will answer with the current state. It will not claim a certification or control the company does not yet have.
hello@revforgeos.com