Security and data handling

Where your data lives

The BrandInAIAnswers app and its Postgres database run on Surge Software's own server in Bengaluru, India, in containers on a private network. The app is not exposed to the internet directly: public traffic reaches it only through Cloudflare. Some processing happens outside India with the providers listed on our subprocessors page.

Encryption in transit

Every page and API call is served over HTTPS by Cloudflare. Traffic from Cloudflare to our server travels through an encrypted Cloudflare Tunnel.

Accounts and keys

• Passwords are hashed with scrypt; we cannot read them. You can also sign in with Google where it is switched on.
• Session cookies are httpOnly and stored hashed. API keys are stored hashed and shown once.
• Password reset links work once and expire after 30 minutes.
• Website fetches you ask for (audits, page rewrites) are blocked from reaching private network addresses.

Who has access

• Inside your workspace: the people you invite. Client logins are read-only.
• At Surge Software: only the small team that runs the service, for support and operations. Server access needs an SSH key over a private network.
• The site assistant on our public pages answers from public help pages only and never sees your workspace data.

AI processing

• Analysis (mentions, position, sentiment) and fix writing run on Surge's own AI server (Qwen) first. Anthropic's Claude is used only as a fallback when our server fails or a check rejects its draft.
• Tracking works by asking AI engines your tracked prompts, so those prompts are sent to each engine being tracked. Today that is our own Surge AI engines and Anthropic's Claude. Surge AI + web search sends search queries through our self-hosted SearXNG to public search engines and reads the top result pages.
• Engines marked coming soon receive nothing until they are connected; each will be added to the subprocessors list first.

Deleting your data

A workspace owner can delete a brand in Settings → Delete this brand: the brand and all its prompts, answers, fixes, logs and report links are deleted together. To delete your whole account or workspace, email [email protected] from the account's address and we will delete it and confirm by email.

Payments

Card and bank details are entered on the payment provider's own page; we never see card numbers. Paid plans are in early access and no payments are taken yet.

Report a security issue

Email [email protected] with the subject "Security". Please give us a chance to fix the issue before sharing it publicly. Business customers can also read our Data Processing Addendum.