Forge focuses primarily on Forge Voice for home repair shops.
Forge Vault is a separate Forge product that remains available for existing customers. New inquiries here route to /contact.html.
Forge Vault: the multi-tenant AI agent platform. Run a thousand agents safely.
The enterprise version of Forge Agent. Per-tenant isolation, RBAC, audit trails, HashiCorp-style credential brokering, SOC 2 controls. Deploy your AI agents at scale without introducing the 14 new attack surfaces your security team is going to ask about.
Three layers. One control plane.
Forge Vault sits on top of the open-source Forge Agent runtime, adds multi-tenancy, and wraps every agent execution in governance controls that your security team can actually verify.
Control Plane
- Tenant + workspace CRUD
- RBAC + permission trees
- SAML / OIDC SSO
- Visual workflow builder
- Agent template library
- Usage metering + billing
Execution Plane
- Sandboxed agent runtimes
- Token-by-token streaming
- Tool call interception + audit
- Per-tenant LLM routing
- Automatic budget caps
- Interrupt + resume state
Security Plane
- Vault-style credential brokering
- Per-request secret rotation
- Structured audit log (SIEM-ready)
- PII redaction in transcripts
- Tool allowlisting
- Export for SOC 2 evidence
Everything the security review asks for.
Per-tenant isolation
Each tenant runs in an isolated namespace with its own state, credentials, and LLM keys. Zero data bleed between customers. Supports bring-your-own-cloud and single-tenant dedicated deploys.
RBAC + SSO
Granular roles: who can invoke which agent, read which transcripts, rotate which credentials. SAML 2.0 and OIDC integrations with Okta, Google Workspace, Microsoft Entra ID.
Structured audit trail
Every prompt, tool call, tool result, and agent decision is logged immutably. Exports to Datadog, Splunk, or your own SIEM in SOC 2 / ISO 27001-compatible format.
Credential brokering
Vault-style secret management purpose-built for agents. Ephemeral, scoped, auto-rotated credentials delivered just-in-time, never stored in agent context.
Budget caps + metering
Per-tenant, per-agent, per-workflow LLM spend caps with soft and hard limits. Real-time usage metering you can bill against or expose to the tenant.
Visual workflow builder
Non-engineer admins can wire up multi-agent workflows without code: triggers, condition branches, human-in-the-loop approvals, scheduled runs. Exports back to Forge Agent code for the engineers.
Audit-ready from day one.
Priced for teams that run agents in production.
Usage included per tier. Overage bills transparently at published rates.
- Up to 5 tenants
- 10,000 agent executions / mo
- Standard audit log
- Email support
- Control plane + 1 workspace
- Up to 50 tenants
- 100,000 executions / mo
- SIEM export + PII redaction
- SAML / OIDC SSO
- Budget caps + metering
- BAA on request
- Priority support, 4-hr response
- Unlimited tenants
- Custom execution volume
- Dedicated cluster or BYOC
- SOC 2 evidence packet
- Data residency (US/EU/custom)
- Dedicated TAM + Slack channel
- 99.95% SLA
What enterprise buyers ask first.
How is this different from running Forge Agent ourselves?
Forge Agent gets you an agent. Forge Vault gets you a hundred agents under governance. Multi-tenancy, RBAC, audit, credential brokering, metering, and a control plane your non-engineers can operate. For a solo app you do not need Vault. For an agency, a SaaS with per-customer agents, or anything your security team has to sign off on, you do.
Can we self-host?
Yes, Enterprise tier. Bring your own Kubernetes cluster or AWS/GCP account and we deploy the Vault control plane into it. All data and credentials stay in your environment; we just provide the software and support.
Which LLMs are supported?
Anthropic (Claude Opus/Sonnet/Haiku), OpenAI (GPT-4o, o1), Google (Gemini 2.5/3.1), AWS Bedrock, Azure OpenAI, and any self-hosted model via Ollama or vLLM. Per-tenant routing: Tenant A uses Claude, Tenant B uses GPT, same platform.
What does "credential brokering" actually mean?
Agents never see long-lived API keys. When an agent calls a tool that needs a credential (Stripe key, CRM token, database password), Vault generates a short-lived, scoped credential just for that call, injects it into the tool invocation, and revokes it after. You audit every use. Drop-in replacement for hard-coded keys in agent context.
Are you SOC 2 certified?
In progress. Type II audit completes Q3 2026. We operate under SOC 2 controls today and can share our in-progress evidence packet and auditor contact on request. HIPAA BAA is available now for medical customers.
Can our tenants bring their own LLM keys?
Yes. Two modes: Vault manages all keys and bills you on usage (simplest), or each tenant brings their own OpenAI/Anthropic/etc key and Vault just brokers. Hybrid models supported too.
The agent governance layer your security team will sign off on.
Book a 30-minute demo. We will walk your team through architecture, show the audit log, and answer every compliance question on the spot.