What do you want to build?

?

New here? Everything on every screen is already filled in with a sensible answer. You can press Continue the whole way through and get a working, secure application. Change only what you care about.

Describe it in your own words — you can change anything later.

Or choose a build type

Nothing is created until you approve a plan on step 6.

Tell us a little more

Eight questions, all already answered with the most common choice. Change any that are wrong. This is where your architecture and your compliance profile get decided — but you only have to think about your business.

?

Two of these matter more than the rest. "Does it store health information?" switches on the HIPAA profile, which changes which services you are even allowed to use. "How many people will use it?" drives the whole cost and scaling picture.

Choose your stack

Four complete, working combinations — not a menu of parts. Each is scored against what you told us, and each says honestly what you give up by choosing it.

?

What is a "stack"? It is the full set of services your application runs on — where the code lives, where it is hosted, where data is stored, how people sign in. Picking one here means you never have to create any of those accounts yourself.

Expert — swap any component

Your architecture

This is how the pieces fit together. Beginners: read it, then press Continue — it is already the right shape for what you described. Experts: change the pattern, add services, redraw boundaries.

?

We chose a modular monolith: one deployable application with strictly separated internal modules. It is the fastest to build, the cheapest to run, and it splits into microservices later without a rewrite. Teams under about eight engineers who start with microservices usually regret it.

Expert — add a service

Accounts & connections

Five services to connect. Forge always uses the strongest method each provider supports, and tells you which one it landed on.

?

Forge never asks for a password. Every connection happens on the provider's own site, or with you signing in yourself. Where the provider supports it, Forge stores nothing at all — it proves its identity at the moment of use and receives credentials that expire in minutes.

⚑

Org policy is on: require_corporate_accounts
Your organisation admin has restricted members to corporate accounts. Personal GitHub and Vercel accounts are hidden. Set in Settings → Policy.

Every connection is labelled with how much Forge has to hold.

Expert — enterprise managed authorisation

✦

Skip this screen entirely

If your identity provider supports it, your organisation can grant Forge access to every approved system centrally — no consent screens, no per-user connections, one place to revoke. Forge exchanges your SSO identity for a scoped grant at your own IdP, which evaluates your policy and writes to your audit log.

Okta Cross App Access Microsoft Entra Agent ID Auth0

Review & provision

This is everything Forge will create. Nothing has been created yet — nothing is charged, nothing exists. Read it, then press the button.

Estate summary

Estimated monthly cost

Change plan — 22 steps

Safe to cancel at any point — completed steps roll back automatically.

Build it

?

Getting it right takes many passes — that is normal. What is not normal is every pass costing the same. Here, the cost of a change matches the size of the change: wording and colour are instant and free, behaviour is a scoped edit, features go through a pull request, and infrastructure needs an approved plan. Pin anything you have already perfected and the agent may not touch it again.

● repo connected ● database live · RLS on ● preview deploying budget $2.40 / $25.00

Checkpoint

What you can change

Pinned — agent may not touch

Agent chat

Live preview Edit mode

Northgate ClinicPatientsIntakeScheduleDocuments

Patient intake

4 awaiting review · 2 consent forms outstanding

Patient	Stage	Consent
A. Whitfield	Documents	signed
M. Okonkwo	Scheduling	signed
J. Delacroix	Intake form	pending

Showing synthetic data · no real patient information exists in this environment

Test it

Forge wrote the tests and generated a realistic dataset, so you do not have to think about test data. Run them, or use the app yourself against the seeded data.

?

The permission boundary and security probe families are the ones that matter. Every publicly reported breach at a comparable AI app builder — exposed databases, an authentication bypass, 303 vulnerable endpoints found across 170 scanned apps in CVE-2025-48757 — would have been caught by these exact tests.

Generated test suite 18 tests

Go to production

Production is created fresh, with clean data and clean metadata. Your synthetic test data is never promoted — the schema goes, the rows do not.

Pre-flight checks

External systems to connect

Everything your application talks to, in one place. Forge walks you through each one.

🛡

Compliance evidence pack — ready

HIPAA Security Rule + SOC 2 control matrix, generated from your actual live configuration. 142 assertions, all passing. Includes data-flow diagrams, a subprocessor list, and configuration snapshots retained for seven years.

Requires security_admin approval — Priya M. approved 14 min ago.

✓

You're live

https://intake.northgateclinic.com

HIPAA profile enforced RLS asserted on 14 tables Zero secrets in repository Backups verified restorable 34/34 tests passing in CI

What just happened

In one session you went from a sentence to a production application: a GitHub repository with branch protection and secret scanning, a CI pipeline with SAST and dependency auditing, three isolated environments, a Postgres database with row-level security enforced on every tenant table, an identity provider with roles scaffolded, a secrets vault the app reads at runtime, observability with alerting, an infrastructure-as-code definition committed to your repository — and a compliance evidence pack generated from the live configuration.

You never opened GitHub, Vercel, or the Azure portal. And because the infrastructure definition lives in your own repository, you could stop paying Forge tomorrow and this application would keep running.