FORGE
Back to portal

Legal

Terms of Service

These Terms of Service govern the use of Forge, the Windows deployment service provided by Asterio Group AB. They apply between Asterio Group AB and the organisation that subscribes to Forge.

Version 1.0. Effective 9 October 2026.

1. Parties and definitions

Asterio, we or us means Asterio Group AB, a limited company registered in Sweden under registration number 559289-1856 (VAT number SE559289185601), with its registered address at Ekebovägen 14, 663 32 Skoghall, Sweden. Contact: forge@asterio.se.

Customer or you means the organisation identified in the Order Form that subscribes to Forge. Forge is a business-to-business service for organisations that deploy Windows on their own devices; it is not offered to consumers.

Order Form means the written order, quotation or agreement in which Asterio and the Customer agree the subscription, the fees and any terms that depart from these Terms.

Agreement means these Terms, the Order Form, the Data Processing Agreement and the Third-party notices. The Privacy notice informs the people who sign in to the portal and is not part of the Agreement.

Forge or the Service means the Forge portal and its programming interfaces, the deployment service, the network-boot service, the Windows installation images, driver packs and boot media that Asterio provides, and the customer-side components described in section 6.

Workspace means the part of Forge dedicated to one Microsoft Entra tenant of the Customer. A Customer may manage several tenant workspaces from one main tenant.

Device means a computer that the Customer starts with Forge boot media or Forge network boot in order to deploy Windows on it.

Deployment means one attempt to install Windows on one Device through Forge, from the Device's request until its completion, denial, failure or expiry.

Users means the people the Customer authorises to sign in to the portal, in the roles View only (Viewer), Deployment access (Operator) and Workspace administrator (Administrator).

Customer Data means the data the Customer and its Devices put into Forge or that Forge records about them: device identities, deployment records and timelines, device log bundles, workspace settings, user access records and audit records.

2. The Service

2.1 What Forge does

Forge installs Windows on the Customer's Devices under the Customer's control. A Device is started from Forge boot media (ISO or USB) or over network boot. Forge recognises the Device by its serial number and hardware information or shows a short pairing code that an authorised User enters in the portal to assign the Device to a Workspace. An authorised User approves or denies the Deployment; alternatively the Customer may opt in to automatic approval of recognised Devices (zero-touch), which is off by default. Forge then verifies the signed deployment metadata, prepares the exact selected disk, downloads and verifies the Windows image, applies Windows and the model drivers, prepares the boot files, restarts into Windows and completes the installation, optionally registering the Device in the Customer's Windows Autopilot tenant. The portal shows every stage, the decisions taken and the errors reported.

2.2 Components of the Service

2.3 What Forge does not do

2.4 Changes to the Service

Asterio may improve and change the Service, for example by adding features, changing the portal, renewing boot releases and media, or replacing components. Asterio will not materially reduce the core functionality described in section 2.1 during a paid subscription term without the Customer's agreement. Features marked as preview may change or be withdrawn at any time.

3. Access and accounts

3.1 Users sign in with their Microsoft Entra accounts. The Customer controls who may sign in through its Enterprise Application assignment in Microsoft Entra, and controls each User's Workspace role in the portal. Signing in does not by itself grant a role; a Workspace administrator or a Forge administrator must assign one.

3.2 The Customer is responsible for the actions of its Users and of anyone who uses its Users' accounts, including the entry of device codes and the approval of Deployments. The Customer must keep its accounts secure, use the sign-in protections it considers appropriate (such as multi-factor authentication and Conditional Access) and inform Asterio without undue delay if it suspects that an account or a Device credential has been compromised.

3.3 Asterio's own administrators (Forge administrators) have separate administrative permissions to operate the Service and support the Customer. They can open any Workspace and see its deployments, devices, users and logs. Their access is authenticated and recorded.

3.4 A Customer that manages several Microsoft tenants may associate additional tenant workspaces with its main tenant. Association alone grants nobody access; each person's access is assigned per Workspace.

4. The Customer's responsibilities

4.1 Licences for the software Forge deploys

The Customer is responsible for holding valid licences for all software that Forge installs or helps install on its Devices, in particular:

Forge installs Windows from images prepared from Microsoft's official media. Forge does not verify, supply or activate licences.

4.2 Approving Deployments and the erasure of disks

The approval of a Deployment authorises Forge to erase the selected eligible disk of the Device and to install Windows on it. No further confirmation is requested on the Device. The Customer acknowledges in particular that:

The Customer must verify that the intended Device is the one it approves, must ensure that no data it needs remains on the selected disk, and must restrict the approval of Deployments to Users who understand these consequences.

4.3 Registering networks

The Customer registers the public IP address ranges of the sites from which its Devices boot and deploy. Network boot and the device deployment channels are admitted only from registered ranges. A Device that starts Forge media outside every registered range may still request a Deployment; the request is flagged with the Device's public address, is never approved automatically, and waits for an explicit approval by one of the Customer's Administrators or Operators. The Customer may turn this exception off. The Customer may also opt in to Boot from home for a chosen period; while any customer has it on, the shared network-boot loader is reachable from any network, and the Customer accepts that shared exposure for the period it chooses. Asterio may open temporary incident access for a Customer at the Customer's request; such access is recorded with its reason and expiry.

4.4 Devices, hardware and testing

The Customer is responsible for the custody of its Devices during deployment, for firmware settings (Secure Boot, boot order, network boot), for choosing supported hardware and media of the right architecture, and for verifying firmware, drivers and installation on test devices before wider use. Physical access to a Device during deployment is sensitive and is the Customer's responsibility.

4.5 Microsoft tenant configuration and consents

The Customer configures its Microsoft Entra tenant for Forge: it assigns Users to the Forge Enterprise Application, grants the consent required for the portal, and decides whether to grant the separate consent required for Windows Autopilot registration and whether to configure a Microsoft Sentinel destination. Azure ingestion and retention charges for a Sentinel destination are the Customer's.

4.6 Customer-side components

Where the Customer installs the Forge Cache, it provides and operates the host (Windows Server 2022, Windows Server 2025 or Windows 11), keeps the host's private address fixed, controls which of its client subnets may reach the cache on TCP port 5094, and verifies the installer's hash and Authenticode signature before installing it. The Customer distributes Forge boot media only within its own organisation and to service providers acting for it, verifies published hashes, and replaces media when Asterio publishes a new release.

4.7 Compliance with law

The Customer uses Forge in compliance with applicable law, including data protection law and export control law, and provides its own Users with the information they are entitled to about the processing of their personal data (see the Privacy notice).

5. Acceptable use

The Customer must not, and must not allow anyone to:

6. Licence to the customer-side components

6.1 For the term of the subscription Asterio grants the Customer a limited, non-exclusive, non-transferable and non-sublicensable licence to install and use the Forge boot media, the network-boot files served by Forge, the Forge Windows PE client and peer worker, the Forge Cache installer, the Forge Cache service and the Forge Cache Setup application (together the customer-side components), solely for deploying Windows on the Customer's Devices.

6.2 The customer-side components contain third-party components. Windows PE and the Windows installation images are Microsoft software, licensed under Microsoft's terms. Driver packs are the manufacturers' software, licensed under their terms. Open-source components are licensed under their own licences, which are listed in the Third-party notices and prevail over this section for those components; for components under the GNU General Public License, Asterio provides the corresponding source code as described there.

6.3 Boot releases and media are time-limited. A signed boot release is valid for at most 30 days and is renewed by Asterio; an expired release closes network boot until the renewal while the portal stays available. Asterio may withdraw a release or media version for security reasons. The Customer must use current media.

6.4 Asterio and its licensors retain all rights in the Service and the customer-side components. The Customer retains all rights in Customer Data. If the Customer gives Asterio suggestions about the Service, Asterio may use them without obligation.

7. Customer Data

7.1 Asterio processes Customer Data only to provide, secure, support and improve the Service, to comply with law, and as instructed by the Customer. Personal data in Customer Data is processed under the Data Processing Agreement. Asterio may use aggregated service metrics that contain no personal data and no Customer identification to operate and improve the Service.

7.2 Customer Data is stored in Microsoft Azure in the Sweden Central region. Deployment records and images are encrypted at rest by Azure. Device proofs are stored as hashes. Credentials, device proofs and raw installer output are excluded from the deployment timelines.

7.3 The Customer can read and export its Customer Data through the portal during the subscription: deployment lists, device lists and user lists, and, per Deployment, Download logs, which saves the deployment timeline and the device log bundles as one zip file. Where enabled, deployment events are also exported continuously to the Customer's Microsoft Sentinel workspace.

7.4 Device log bundles uploaded by Devices are deleted 30 days after upload. Deployment timelines and audit records are kept with the deployment record and the customer record. Removing a Deployment from the history list hides it; its logs and audit records are retained. Removing a Device revokes its earlier credentials and keeps its history.

8. Availability, maintenance and support

8.1 Asterio will use reasonable efforts to keep the Service available around the clock, excluding maintenance. The Service currently runs on single-instance Azure resources in one region and is not a highly available deployment; a worker restart or an Azure incident can interrupt it. The Service is provided on a best-effort basis: Asterio gives no guaranteed availability or uptime, and no service credits or other remedies apply to unavailability.

8.2 Asterio may perform planned maintenance and will announce it in the portal where practicable. Emergency maintenance may be performed at any time. The monthly renewal of boot releases does not interrupt the portal.

8.3 Asterio provides support for the Service to the Customer's administrators by e-mail to forge@asterio.se on Swedish working days (Monday to Friday, excluding public holidays) between 08:00 and 17:00 Swedish time. Support covers the documented behaviour of the Service. It does not cover the Customer's hardware, networks, Microsoft tenant, licences or third-party software beyond the way Forge uses them.

8.4 The Service depends on services that Asterio does not control, including Microsoft Entra ID, Microsoft Azure, Microsoft Graph, Microsoft's content delivery for Office, and the manufacturers' catalog and download services. Asterio is not responsible for their availability or changes.

9. Fees and payment

9.1 The Customer pays the fees agreed in the Order Form; prices are not published. Fees are invoiced yearly in advance for each subscription year and are payable 30 days net from the invoice date. Fees exclude value added tax and other applicable taxes.

9.2 Where fees depend on the number of devices, that number is the number of the Customer's Windows devices registered in Microsoft Intune or Windows Autopilot in the Customer's tenants, counted once per device (a device that appears in both is counted once, matched by serial number). Asterio determines the number once a year, at the start of each subscription year, from the information Forge reads from the Customer's tenants, and the Customer may ask for the underlying list.

9.3 Late payments bear interest under the Swedish Interest Act (räntelagen). If an undisputed invoice remains unpaid 30 days after a written reminder, Asterio may suspend the Service until payment is received.

9.4 Charges for the Customer's own Microsoft or Azure services, including Sentinel ingestion and retention, Intune and Windows licences, are the Customer's.

10. Term, suspension and termination

10.1 The subscription runs for one year from the start date in the Order Form and renews automatically for further periods of one year unless either party gives written notice of termination at least three months before the end of the current period.

10.2 Either party may terminate the Agreement with immediate effect by written notice if the other party materially breaches it and does not remedy the breach within 30 days of a written notice describing it, or if the other party becomes insolvent, enters into bankruptcy or liquidation, or ceases trading.

10.3 Asterio may suspend or restrict the Customer's access to the Service, archive a Workspace, revoke Device or cache credentials, or close network admission, to the extent necessary to prevent or stop a security incident, abuse, a breach of section 5, a risk to other customers or to the Service, or to comply with law or a court order. Asterio will inform the Customer promptly and restore access when the cause has been resolved. Archiving stops new activity in a Workspace; it does not interrupt work a Device has already started.

10.4 On termination the Customer's right to use the Service and the customer-side components ends, except to the extent an open-source licence grants rights that survive. Fees due for the period before termination remain payable. Sections 6.4, 7, 11, 12, 14, 15 and 18 survive termination.

11. Data return and deletion

11.1 For 30 days after termination the Customer may export its Customer Data through the portal in read-only mode, including Download logs for each Deployment. On request Asterio provides reasonable assistance with the export.

11.2 After that period Asterio deletes the Customer's Customer Data, including device identities, deployment records, log bundles, user access records and cache enrolments, within 90 days, except for data Asterio must retain under law (for example accounting records) and anonymised service metrics. Database backups expire 35 days after they were taken. Asterio confirms the deletion in writing on request.

11.3 Content that Devices downloaded, and data on the Customer's own Forge Cache hosts, is under the Customer's control and is not deleted by Asterio.

12. Confidentiality

Each party keeps the other party's confidential information (including the Order Form, security documentation, non-public technical information and Customer Data) confidential, uses it only to perform the Agreement, and discloses it only to employees, advisers and subcontractors who need it and are bound by confidentiality. This does not apply to information that is public without breach, already known or independently developed, or that must be disclosed by law or court order. The obligation lasts for the term of the Agreement and five years thereafter, and for Customer Data for as long as Asterio holds it.

13. Warranties and disclaimers

13.1 Asterio warrants that it provides the Service with reasonable skill and care and materially in accordance with its documentation, and that it has the right to grant the licences in section 6.

13.2 Except as stated in this Agreement, the Service and the customer-side components are provided without further warranties. In particular, Asterio does not warrant that every device model, firmware, hypervisor or driver works with Forge, that a Deployment will complete on a given Device, that Microsoft or manufacturer services will be available, or that the Service is free of interruptions. Device-reported progress is not an independent verification that an installation succeeded.

13.3 The Customer is responsible for the data on the disks it approves for erasure (section 4.2) and for the licences in section 4.1.

14. Liability

14.1 Neither party is liable to the other for indirect or consequential loss, loss of profit, loss of business, or loss of or damage to data on a Device whose Deployment the Customer approved, however arising.

14.2 Each party's total liability under or in connection with the Agreement in any twelve-month period is limited to the fees paid and payable by the Customer for the Service in the twelve months preceding the event giving rise to the claim.

14.3 The limitations in this section do not apply to liability for intent or gross negligence, for death or personal injury, for breach of section 12 (Confidentiality), or where liability cannot be limited under applicable law. Liability under the Data Processing Agreement follows Article 82 of the GDPR and the limitations of this section as far as the GDPR permits.

15. Indemnities

15.1 The Customer indemnifies Asterio against third-party claims, fines and costs arising from the Customer deploying Windows or other software without the required licences, from the Customer deploying or erasing devices it was not authorised to control, or from a breach of section 5.

15.2 Asterio indemnifies the Customer against third-party claims that the Service, as provided by Asterio, infringes the third party's intellectual property rights, provided the Customer notifies Asterio promptly, lets Asterio control the defence and cooperates. This does not cover third-party components as such, Customer Data, or combinations with products not supplied by Asterio. If a claim is made, Asterio may modify or replace the affected part of the Service or, if that is not reasonably possible, terminate the affected part and refund prepaid fees for the remaining term.

16. Changes to these Terms

Asterio may update these Terms. Asterio will give the Customer's Workspace administrators at least 30 days' notice of a change in the portal or by e-mail to the contact in the Order Form. If a change materially reduces the Customer's rights, the Customer may terminate the Agreement with effect from the date the change takes effect and receive a refund of prepaid fees for the remaining term. Continued use after the effective date constitutes acceptance. The current version and its effective date are stated at the end of these Terms; previous versions are available on request.

17. General

17.1 The Agreement is the entire agreement between the parties about the Service and supersedes earlier agreements and representations about it. In case of conflict, the Order Form prevails over the Data Processing Agreement, which prevails over these Terms, which prevail over the Third-party notices, except that an open-source licence prevails for the component it covers.

17.2 Neither party may assign the Agreement without the other's written consent, except to an affiliate or a successor to its business that assumes the Agreement. Asterio may use subcontractors, including Microsoft as hosting provider, and remains responsible for them.

17.3 Neither party is liable for failure to perform caused by circumstances beyond its reasonable control, such as failures of Microsoft services, Internet outages, acts of authorities or natural events, provided it informs the other party and resumes performance as soon as possible.

17.4 Notices under the Agreement are given in writing to the contacts in the Order Form; Asterio may also give notices in the portal.

17.5 If a provision of the Agreement is invalid, the remainder stays in force and the provision is replaced with a valid one that comes closest to its purpose. A failure to enforce a right is not a waiver of it.

18. Governing law and venue

The Agreement is governed by the laws of Sweden, excluding its conflict-of-law rules and the United Nations Convention on Contracts for the International Sale of Goods. Disputes arising out of or in connection with the Agreement are settled by the Swedish courts, with Värmland District Court (Värmlands tingsrätt) as the court of first instance. Either party may seek interim relief in any competent court.

Version 1.0. Effective 9 October 2026.