Security
Security and privacy
SOC 2: not certified yet. We don't hold ISO 27001 either. These are the controls we follow today.
Passwordless sign-in
Six-digit email codes that expire in 10 minutes, with a limit of five attempts. Session tokens are stored hashed.
Hashed API keys
Workspace API keys (sd_live_…) are stored as hashes. We show a key once, when you create it.
Workspace isolation
Every record carries its workspace id, and every query is scoped to it. Automated tests check it. Agency client workspaces keep their data separate too.
Encrypted secrets
Keys and tokens for your integrations and data providers are encrypted at rest with AES-256-GCM, using a server-held data key.
Audit log
Lead approvals, suppressions, plan changes, accepted weight changes, new client workspaces and workspace deletion are recorded per workspace.
Signed webhooks
HMAC-SHA256 signatures with a 5-minute replay window, and idempotency keys on every push.
AI on our own servers
Signals and drafts are processed by Surge's own AI server (Qwen) by default. Claude is used only if it is switched on as a fallback. Your data is not used to train models.
Suppression list
Unsubscribes, "asked to stop" replies and 'do not contact' requests stop a person in every agent.
No LinkedIn scraping
We don't scrape LinkedIn or automate your LinkedIn account. Our Chrome extension does not read LinkedIn or Naukri pages.
Visitor privacy
We identify companies, not individual visitors, unless they identify themselves.
Your data, your call
Export the whole workspace as JSON (secrets masked) or delete it permanently from Settings.
Payments
Card and UPI details are handled by Razorpay and Stripe; we never see card numbers.
Read our data processing addendum and subprocessor list (both drafts). Questions: [email protected].