Security, in plain facts

You are giving us an admin key. Here is exactly what happens to it.

Where your data lives

On Surge AI's own server in Bengaluru, India, in a PostgreSQL database. Public traffic reaches it only through a Cloudflare tunnel; the app port is not open to the internet.

Provider keys

Encrypted with AES-256-GCM (a random 12-byte IV per key) before they are written to the database. The encryption key is kept outside the database. Keys are never shown again in the app, sent in emails, or written to logs; you see only the last 4 characters.

What we read

Usage, cost, rate-limit and key/project names from the provider's admin APIs. We do not read prompts, completions or files, and the APIs we use do not expose them.

What we can change

Nothing, unless you turn on the kill switch for a connection. Then only: set an Anthropic key to inactive or active, pause or unpause a Vercel project, or delete an OpenAI project key. Every attempt is written to an audit log you can see.

AI training

We do not train any AI model on your data, and we do not send your data to any AI service.

Passwords

Hashed with scrypt and a random salt. Sessions are signed cookies (HMAC-SHA256), HTTP-only, 30 days.

Retention

Hourly usage estimates are deleted after 15 days. Daily cost history stays while your account exists. Delete a connection and its key and data go at once. Close your account and everything is deleted within 30 days (backups roll off after 7 days).

Sub-processors

Cloudflare (network tunnel and DNS), Resend (alert and digest emails: your email address and the alert text), Razorpay (payments: they hold card details, we never see them), Telegram (only if you link a chat). Web push goes through your browser's push service (Google, Apple or Mozilla), encrypted end to end.

Backups

One database dump per night, kept for 7 days on the same server.

Certifications

None. We are a small team and do not claim SOC 2 or ISO 27001.

Report a problem

Email [email protected]. We reply within 2 working days.