ForceDream · Trust Center

Forcedream Ai Trust Center

Trust center

A provider-built Trust Centre (not a Vanta/Drata portal) with seven sub-pages. It is unusually candid: the compliance page ticks UK GDPR, Cyber Essentials Plus and FCA Consumer Duty evidence workflows, and marks SOC 2 Type II and ISO/IEC 27001 with a dash and the sentence "ForceDream is not certified" — attributing those to Google Cloud for the London region it runs in. The site footer's "SOC2 in progress" badge and /v1/capabilities ("soc2":"planned","iso_27001":"planned") agree. The initial keyword probe recorded "SOC 2" from the page text; that is corrected here because the page's substance is a denial, not a claim.

ForceDream maintains a public trust center documenting Cyber Essentials Plus, UK GDPR, and FCA Consumer Duty (PS22/9) compliance.

AI AgentsAgent MarketplaceMCPA2ACryptographic ProofsAI Inference RoutingAgentic PaymentsAgentic CommerceAgent-NativeUnited Kingdom
Trust center: https://www.forcedream.com/trust

Certifications & Compliance

Cyber Essentials PlusUK GDPRFCA Consumer Duty (PS22/9)

Source

Trust Center

Raw ↑ 
generated: '2026-09-19'
method: searched
probe: true
source: https://www.forcedream.com/trust
url: https://www.forcedream.com/trust
alt_urls:
  - https://forcedream.ai/trust/
  - https://www.forcedream.com/trust/compliance
  - https://www.forcedream.com/trust/controls
  - https://www.forcedream.com/trust/ledger
  - https://www.forcedream.com/trust/sla
  - https://www.forcedream.com/trust/developer
  - https://www.forcedream.com/trust/enterprise
  - https://www.forcedream.com/trust/subprocessors
description: >-
  A provider-built Trust Centre (not a Vanta/Drata portal) with seven sub-pages. It is unusually candid: the
  compliance page ticks UK GDPR, Cyber Essentials Plus and FCA Consumer Duty evidence workflows, and marks
  SOC 2 Type II and ISO/IEC 27001 with a dash and the sentence "ForceDream is not certified" — attributing
  those to Google Cloud for the London region it runs in. The site footer's "SOC2 in progress" badge and
  /v1/capabilities ("soc2":"planned","iso_27001":"planned") agree. The initial keyword probe recorded "SOC 2"
  from the page text; that is corrected here because the page's substance is a denial, not a claim.
certifications:
  - name: Cyber Essentials Plus
    status: claimed
    evidence: '"Cyber Essentials+ — UK government-backed cyber security certification." (trust/compliance, tick)'
  - name: UK GDPR
    status: claimed (compliance statement, not a certification)
    evidence: '"UK GDPR — Data residency in eu-west-2 London. DPA available on request." (trust/compliance, tick)'
  - name: FCA Consumer Duty (PS22/9)
    status: product capability, listed under certifications
    evidence: '"Evidence gathering and audit workflows for PS22/9." (trust/compliance, tick)'
explicitly_not_held:
  - name: SOC 2 Type II
    evidence: '"ForceDream is not SOC 2 certified. Our hosting provider, Google Cloud, is certified for the data centres we run in."'
  - name: ISO/IEC 27001
    evidence: '"ForceDream is not certified. Google Cloud holds ISO/IEC 27001 for the London region we run in. We would rather say this than let a tick imply otherwise."'
regional_compliance_named: [Nigeria NDPR, Kenya DPA 2019, South Africa POPIA, Singapore PDPA]
security_controls:
  encryption: AES-256 at rest; TLS 1.3 in transit; SHA-256 WORM seals
  access_control: sk_fd_ keys never stored in plaintext, shown once; GitHub/Google OAuth for humans; immediate revocation via POST /v1/account/keys/revoke
  fraud: 8-signal payout fraud scoring (account age, velocity, IP reputation, amount ratio, device fingerprint, geographic anomaly, hour pattern, recent activity)
  audit: append-only SHA-256 hash chain, verifiable at GET /v1/ops/worm/verify/:seal; audit export GET /v1/audit/export
  deployment: '"Every deployment runs all 69 smoke tests before going live; failed tests trigger automatic rollback"'
data_residency: eu-west-2 London primary; backups eu-west-1; enterprise options London, Dublin, Virginia, Singapore
dpa: '"DPA — GDPR Article 28. trust@forcedream.ai" (on request; not published)'
subprocessors: https://www.forcedream.com/trust/subprocessors (dated table, 15 May 2026)
contacts:
  trust: trust@forcedream.ai
  security: security@forcedream.com
  privacy: privacy@forcedream.com
  response_commitment: '"Our trust team responds within one business day."'
evidence:
  - source: https://www.forcedream.com/trust/compliance
    http_status: 200
    fetched: '2026-09-19'
  - source: https://www.forcedream.com/trust
    http_status: 200
    fetched: '2026-09-19'
  - source: https://api.forcedream.ai/v1/capabilities
    http_status: 200
    fetched: '2026-09-19'
    quote: '"compliance":{"uk_gdpr":"compliant","eu_gdpr":"compliant","soc2":"planned","iso_27001":"planned","note":"Google Cloud and Vercel hold certifications for the underlying infrastructure. ForceDream holds none of its own."}'
compliance_pointer_basis: >-
  type: Compliance is emitted on the strength of a published compliance programme (Cyber Essentials Plus
  claimed, UK GDPR statement, named regional regimes, sub-processor table, security controls page) — not on
  SOC 2 or ISO 27001, which the provider disclaims.

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this
  • find_securityBrowse and filter every security artifact in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This security artifact 
curl "https://apis.io/api/v1/security/forcedream-ai-trust-center"
All security posture 
curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.