Security, stated plainly.

True today, on this website

• No trackers. No analytics, no tracking tools and no cookies. See the privacy note.
• No third-party requests. Every page loads only from forest.ws.
• Strict browser policies. A content security policy and other security headers are sent with every page.
• A published security contact. Our security.txt lists how to reach us.

Planned for the service

• Isolation by full virtual machines. Each server is planned as its own VM with its own kernel, not a container sharing one.
• EU hosting. Servers are planned to run in the EU.
• Key-based access. SSH keys for access to your servers.
• Plain disclosure. If something goes wrong, we plan to say so, in plain language.

What we don’t claim

We hold no certifications and make no compliance claims. If that ever changes, it will be stated here, together with the evidence.

Responsible disclosure

Found a problem with forest.ws? Email hello@forest.ws with what you found and how to reproduce it. Please give us time to fix it before sharing details publicly. We’ll reply, keep you updated, and credit you if you’d like.