Encrypted everywhere: All traffic between your browser and SurgeTK uses HTTPS, and we enforce modern browser protections to block unsafe content and framing.

Strong account security: Email verification is required for new accounts. Two-factor authentication (2FA) with an authenticator app is required for email-and-password sign-in. We throttle sign-in and code-entry attempts to stop brute-force attacks.

Locked-down storage: Imported files, Surge packets, and exports live in private Amazon S3 buckets and are shared only through short-lived, expiring links. Profile photos, firm logos, and client photos are served from public image URLs.

Restricted database access: Our database is hosted on MongoDB Atlas and is reachable only from approved network locations over encrypted connections. It is not open to the public internet.

Trusted infrastructure and vendors: We run on Heroku and rely on a short list of vetted providers, listed at the end of this page.

Email verification: New accounts must verify ownership of the email address with a short-lived code before they can use the platform.

Two-factor authentication (2FA): When you sign in with your email and password, SurgeTK requires a code from an authenticator app after your first use. This reduces the risk of account takeover even if a password is guessed or phished. You manage it under Settings › My Security.

Sign in with Google or Microsoft: If you sign in with Google or Microsoft, SurgeTK relies on that provider's own multi-factor protection for your workspace account.

Rate limiting: We limit how often anyone can try passwords, 2FA codes, or verification codes. Excessive attempts are blocked and recorded as high-severity security events.

Protected sessions: Sign-in cookies are sent only over HTTPS and are not readable by scripts. A session ends after 7 days without activity.

Sign-in awareness: Each sign-in records the time, the approximate location (city and region), and the browser. You can review your last 10 sign-ins under Settings › My Security.

Always-on HTTPS: Connections to SurgeTK are encrypted in transit, and we tell browsers to only ever use secure connections when talking to our site.

Strict website rules: A content security policy limits what can run on our pages and which sites our app can connect to. The app loads scripts only from a short allow-list of providers: Stripe (payments), Intercom (support), Mixpanel (product analytics), Sentry (error monitoring), and the content delivery networks that serve our fonts and interface libraries. Vimeo and Loom are allowed only for embedded training videos.

Private by default: Spreadsheets you import, Surge packets, Value Add PDFs, and exports are stored in private Amazon S3 buckets and are not directly accessible. When the app needs to show one, it uses a short-lived link that expires within minutes (up to one hour for packet downloads).

Encryption at rest: Amazon S3 applies server-side encryption to stored files by default.

Images: Profile photos, firm logos, and client photos are served from public image URLs so they can display quickly across the app. Do not upload documents as images.

Approved-only access: Our MongoDB Atlas database is reachable only from allow-listed network locations and requires encrypted connections. There is no broad "open to the world" access.

Hardened hosting: SurgeTK runs on Heroku. Database traffic leaves our app through fixed, known IP addresses so the database access rules stay precise.

Explicit opt-in: CRM integrations are off by default and only activate when an Admin connects them.

Scoped access: Zoho is connected with read-only OAuth scopes. Redtail is connected with your Redtail username and password.

Encrypted transport: All data pulled from Redtail and Zoho is transmitted over HTTPS.

Credentials at rest: Your Redtail password is encrypted at rest with AES-256-GCM and is never visible to SurgeTK staff in plain text. Zoho uses OAuth, so SurgeTK never sees your Zoho password.

Read-only: SurgeTK never writes anything back to your CRM.

Manual syncs only: Nothing runs on a schedule. An Admin starts every sync.

Revocable at any time: An Admin can disconnect Redtail or Zoho from Settings › Integrations. Disconnecting removes the stored credentials and stops further syncs. Data already synced stays in SurgeTK.

What is read: the meetings inside that Surge's date range, with their time, time zone, name, location, and invitee names and email addresses. Invitee emails are matched to your clients' email addresses so each meeting lands on the right household.

What is not read: payment details, messages, or any Calendly data outside the Surge's date range.

Nothing is written to Calendly.

Encrypted connections: Calendly data is fetched over HTTPS, and the stored connection token is encrypted at rest.

User-controlled: An Admin can disconnect Calendly at any time. Meetings already synced stay on the Surge calendar.

No card data stored by SurgeTK: Card details are collected and processed directly by Stripe. SurgeTK never sees or stores full card numbers. We keep only the card brand, last four digits, expiry, and billing address so you can recognize the card on file.

Encrypted transport: All payment activity happens over HTTPS.

Industry-standard compliance: Stripe maintains PCI DSS compliance for payment processing.

Secure mode: SurgeTK generates a signed, time-limited identity token so Intercom can verify who you are without ever receiving your password or session cookie.

Scoped data: Intercom receives your name, email address, firm, role, and plan so support can help you effectively.

Blocked by default: SurgeTK blocks third-party scripts, frames, and resources unless they are explicitly approved.

Short allow-list: Only the providers named on this page are permitted to load, and only in the contexts where they are required.

Ongoing review: We review third-party services regularly to ensure they continue to meet our security and privacy standards.