Privacy & Security
Forward 360 · Effective 2026-09-29
What we collect
Forward 360 is an invitation-only private network. When you inquire about membership we collect your name, email, an indication of your investable-asset range, your primary source of wealth, and what is prompting you to explore Forward 360 — only what we need to understand fit before a conversation. When you onboard we also collect identifying information required for financial engagements — legal name, address, phone, date of birth, Social Security number, and driver's license — together with the data you enter into your Playbook (Life Design, Document Hub, Investment GPS, and Manifesto).
How it is stored
Sensitive personal information is encrypted at the database column level using AES-256. The encryption keys are managed by AWS Key Management Service — never stored in our application code, and never accessible to layers of the system that do not require them. As an added layer of protection, your records and uploaded documents are also stored on Amazon S3 — encrypted at rest and kept separate from the application database. Access to your record is restricted by row-level security — our database refuses to return another member's data even if our application code contains a bug.
Who can see your information
You — always. Access inside Forward 360 is role-based and scoped to the work: the people serving your relationship see only what that work requires, and there is no firm-wide view of your Playbook and no browsing. Your information becomes visible to the firm when you engage us directly — for example, in a Design Session — and every internal access, by a person or by the system, is recorded in a tamper-evident audit log. We do not sell your data, and we do not share it with third parties except as strictly required to operate the service (for example, our hosting providers and our transactional email provider, which only handle encrypted blobs or minimal routing metadata).
Connecting your own tools and agents
Some members use their own AI tools — a personal assistant or agent such as Instinct — and may want to connect one to their Playbook. We treat that as your decision, not ours. Forward 360 never sends your data to an outside agent on its own; a connection happens only when you initiate it, you control what it can reach, and you can revoke it at any time. Every connection and access is recorded in the same audit log as everything else. One honest limit: once you direct your data to a tool or service you control, it operates under that provider's terms, not ours — our commitments protect your data inside Forward 360. We will always tell you, in plain language, what leaves Forward 360 and what stays.
Your rights
You may request an export of your Playbook, correction of any stored information, or deletion of your account at any time by emailing privacy@forward360.io. Deletion is permanent and cannot be undone.
Security practices
Our application runs under TLS with strict transport security enabled. Session cookies are HttpOnly and scoped to our domain. Administrator privileges are bound to identity provider claims, not to flags in our own database. We enforce password complexity and do not accept public signups — every member joins through a verified invitation.
Questions
For anything related to this policy, email privacy@forward360.io.