SECURITY

Forethought's services operate effectively without requiring personal data. For all data captured, Forethought carefully uses automation to redact sensitive data elements, such as Personally Identifiable Information (PII), Protected Health Information (PHI), and financial records (such as bank and credit card information), during the ingestion process in a secure environment. Once the redaction process is completed, the original data is securely deleted within 24 hours. While we make every effort to ensure that all sensitive data elements are removed, the redaction mechanisms are provided on a best effort basis. The final data used by Forethought should not contain any sensitive data elements.

Forethought is not currently FedRAMP certified; however, our security controls are aligned with NIST 800-53 standards as demonstrated through our annual SOC 2 Type II audits. We operate on AWS infrastructure that maintains FedRAMP Moderate authorization, leveraging a shared responsibility model where AWS provides FedRAMP-compliant physical and infrastructure security while Forethought implements application-level security controls aligned with federal standards.

Forethought's solution is not in scope for FedRAMP authorization based on section 7 of the FedRAMP authorization boundary guidance. This guidance specifies that corporate services are outside of the FedRAMP boundary if they do not contain federal data or unauthorized metadata. For corporate systems processing or storing federal metadata (indirect impact), Forethought owns and operates the system and attests that our security controls meet the requirements outlined in NIST SP 800-171 or at an equivalent security level. Additionally, Forethought de-identifies sensitive data elements and aligns with the de-identification standards from NIST SP 800-188, allowing it to be classified as handling Corporate and Non-Impact Data or Federal metadata/Low and Limited-Impact Data. Therefore, Forethought can be considered outside the authorization boundary per current FedRAMP PMO guidance. Forethought recommends that customers consult with their FedRAMP 3PAO (Third Party Assessment Organization) to obtain formal guidance and confirmation, as the above guidance is based on Forethought's internal interpretation and experience with other customers.

Forethought controls and processes are aligned with the HIPAA requirements which can be demonstrated in the HIPAA Audit Report Report on Compliance with The HIPAA Security, Breach Notication, and Privacy Requirements. As required by OCR with all applicable entities (Covered entities and Business Associates) associate should follow the Minimum Necessary Requirements as set forth in 45 CFR 164.502(b), 164.514(d) and not send PHI data to Forethought if not required.

We have listed of all our questions on this section of the Trust page. You can find more detailed information about Forethought’s architecture, security policies, and other technical information in the documents section.

You can also contact us at support@forethought.ai or reach out to your sales executive or customer success manager.