The idea is simple, even if the engineering behind it isn't: each person only ever sees what belongs to them — and everything that happens is written down, automatically, so nobody has to take your word for it.

Most systems get this half right with a login screen. A login tells you who someone is. It doesn't stop them from stumbling onto data that was never meant for them — another branch's customer list, another client's invoices, another patient's file, another partner's numbers. That gap is where trust usually breaks down, and it's the part most off-the-shelf software never actually solves.

Diagram comparing a typical system, where a login verifies identity but still leaves data shared and exposed to other branches, clients and partners, against Forge Vertical's approach, where each user — host, traveller, partner, affiliate — only ever reaches their own data, with every login, access, change and action written to an automatic audit trail.
In practice

Sensitive data is hiding in every business.

The exact shape changes depending on who you are. The underlying problem doesn't.

Franchises
One franchisee can't see another's numbers — financials, customers and bookings stay inside that branch alone.
Head office still sees everything — one dashboard, every branch, in real time.
A record changed is a record logged — who changed it, what it was, when.
Financial data
Each client has their own private space — never a shared folder or a group inbox.
The bookkeeper keeps full oversight across every client, from one place.
Built to work with what's already used — Sage, Pastel and similar systems.
Marketplaces
Every partner sees only their own dashboard — not another partner's bookings or numbers.
Access is granted by invitation, never automatic — and can be switched off in one click.
Payment data lives in a locked vault, not a plain file anyone could stumble into.
Infographic in two halves: a typical system where a login verifies identity but data stays shared and unisolated, leaking to other branches, clients and partners; versus Forge Vertical's approach, which is private by design and isolated by default, with host, traveller, partner and affiliate accounts each reaching only their own data, and every login, access, change and action written automatically to an audit trail, giving complete isolation and full transparency.
What changes

What you actually get

No jargon. Just what changes once this is built properly, from day one.

See It Instantly

One dashboard shows exactly who has access to what, right now — not a guess, not a spreadsheet someone forgot to update.

Switch It Off

A partner, franchisee or staff member leaves — one click removes their access completely. No waiting on a developer.

Nothing Silent

Every change is written down automatically — what it was, what it became, when, and who did it.

Built for POPIA

Access rules, activity records and one-click removal that help you meet your POPIA duties around who can see personal information.

Works With What You Have

Connects to the tools already in use — Sage, Pastel, Google Workspace — rather than asking a business to start over.

Built In, Not Bolted On

Privacy is part of how the system is built from day one, not a switch someone has to remember to turn on.

Not theory — live, today

Here's exactly how this works, in plain English.

This isn't a pitch for something that might work. It's a description of TripSpace Global — a marketplace Forge Vertical built and runs — using the same approach described above.

Marketplace
TripSpace Global
Commission-free bookings
  • The full admin dashboard — bookings, revenue, every business on the platform — is reachable by one person. Everyone else is shut out, and every attempt to get in is recorded.
  • Partners don't get access automatically. Someone has to be individually approved, and has to agree to the platform's terms, before they're ever let in.
  • Once approved, a partner sees their own dashboard — and nothing else. They can't see another partner's numbers, bookings, or customers, even though they're all using the same platform.
  • Access can be switched off the same way it was switched on — one click revokes a partner's access entirely, immediately, no waiting on a developer to go dig through a database.
  • Payment details aren't sitting in a spreadsheet or a plain file anywhere. They're held in a dedicated, locked vault built for exactly that purpose, kept apart from everything else and not in a folder someone could stumble into.
  • Information moving between a host and a traveller is encrypted in transit — scrambled so that even if it were intercepted somewhere in between, it couldn't be read.
Where this applies

If more than one type of person logs in, this is for you.

The exact shape changes depending on the business. The underlying principle doesn't.

Franchise & multi-branch businesses
Head office needs to see everything. Each branch or franchisee needs to see their own — and nothing belonging to anyone else, even though they're all on the same system.
Financial firms & bookkeepers
Every client uploads and receives their own documents through their own private space — never a shared folder, a group inbox, or a login where one client could stumble onto another's financials.
Medical practices
Patient records are among the most sensitive information there is. Reception, practitioners, billing and management each see what their job needs and nothing more, with a record of who opened what.
Law firms
Client files are confidential by nature. Each matter is visible only to the people working on it, and the partners keep the full picture, with every access recorded.
Any business holding other people's data
Customer records, supplier contracts, staff information, company financials — anything that would cause real damage if the wrong person saw it, or if it simply disappeared without anyone noticing who took it.
POPIA

This isn't just good manners. It's the law.

Under South Africa's Protection of Personal Information Act, a business holding customer, staff, or client data is the responsible party — legally on the hook for how that information is accessed, stored, and protected. "We trusted the software" isn't a defence if access wasn't actually controlled.

Forge Vertical's founder is also an active bug bounty researcher across HackerOne, Bugcrowd, and YesWeHack — which means the same eye used to find gaps in other people's systems is the one reviewing every access rule before it ships in yours.

Simple next step

Deciding is easy.

No technical homework. This is all that happens.

1. Tell us how your business runs
Branches, practitioners, staff, clients: who needs to see what. A short chat in person or on WhatsApp is enough.
2. We show you the picture
A simple diagram of who sees what, in plain language, and what it would take to build.
3. You decide
No jargon and no pressure. If it is right for you, we start. If not, you still know what good looks like.
Common questions

Quick answers.

What does 'only sees what they're meant to see' actually mean?

Each person who logs in sees only their own information, or what they have been specifically given permission to see. A franchisee can't see another franchisee's numbers. A client can't see another client's documents. The rules are built into the system itself, not left to a setting someone could get wrong.

Is this different from a normal login?

Yes. A normal login only checks who you are. This also controls what you can see once you are in, and writes down everything that happens, so a slip on one screen shouldn't expose someone else's information.

Is this right for a medical practice or a law firm?

Yes. Any practice that holds sensitive records about patients or clients needs each person to see only what their job requires. We talk through how your practice works and show you what the access should look like. We also confirm with you any rules your professional body sets.

Do you have a live example?

Yes. TripSpace Global, Forge Vertical's own accommodation marketplace, runs on this model today. Partners are individually approved, each sees only their own dashboard, and payment details are kept in a locked, separate vault rather than a plain file.

What happens when I get in touch?

We talk, in person or on WhatsApp, whichever you prefer. You tell us how your business runs and who needs to see what. We then show you, in plain language, what the access should look like and what it would take to build. You decide once you have seen it.

Know exactly who can see what.

Tell us how your business runs — branches, practitioners, clients, staff — and we'll show you, in plain language, who should see what.

Start the conversation → WhatsApp Jarrit