Collaboration & Tenant Isolation
ForgeHub is built so many tenants can safely share one cluster without ever touching each other.
Invite collaborators
Share workspace access with teammates using three roles:
- Editor — full read/write access.
- Viewer — read-only access.
- Client — sees one app only, perfect for handoffs and reviews.
Per-tenant isolation
Every workspace runs in its own Kubernetes namespace with:
- Network policies — cross-tenant traffic and RFC1918 egress are blocked.
- Resource quotas — CPU and memory are capped per workspace.
- Scoped secrets — environment variables are per-namespace.
A noisy neighbor is impossible by design.
Data on cancel
If you cancel, data is kept for 30 days — re-subscribe and pick up exactly where you left off. After 30 days the namespace and its volumes are deleted.