Last updated October 8, 2026
SurgeTK ("Company," "we," "us," or "our") values your privacy and is committed to safeguarding the confidentiality, integrity, and security of the personal information we receive through our platform. This Privacy & Security Policy explains how we collect, use, disclose, and protect information, consistent with applicable federal and state laws, including the Gramm-Leach-Bliley Act (GLBA), SEC and FINRA guidance, and other privacy regulations.
Information We Collect
We collect and maintain information necessary to provide secure financial technology services, including:
Personal Information: Name, email address, login credentials, authentication factors.
Financial Information: Client account identifiers, account balances, transaction data (as provided by you or your integrations).
Usage Data: Device, browser, IP address, approximate sign-in location, login times, and interactions with the SurgeTK platform, including product analytics events and session recordings in which all text and numeric content is masked.
Communications: Messages exchanged with our support team through in-app chat or email.
How We Use Information
We use collected information to:
Deliver, maintain, and improve the SurgeTK platform.
Authenticate and protect user accounts.
Provide secure file storage and account management features.
Detect, investigate, and prevent fraudulent or unauthorized activity.
Comply with applicable legal, regulatory, and contractual obligations.
We do not sell or rent personal information to third parties. We do not use your information, or your clients' information, to train artificial-intelligence or machine-learning models, and we do not permit our service providers to do so.
Information Sharing & Disclosure
We share information only in limited circumstances:
Vendors & Service Providers: With service providers that help us run the platform, including Heroku (hosting), MongoDB Atlas (database), Amazon Web Services (file storage), Stripe (payments), Intercom (support), SendGrid (email), Sentry and New Relic (monitoring), and Mixpanel and PostHog (product analytics). The complete list is on our Subprocessor List at https://app.vanta.com/surgetk.com/trust/cajo26wc4ytpjpd4zys2xt (Subprocessors tab).
Regulatory & Legal: When required by law, regulation, subpoena, or request from regulatory authorities such as the SEC, FINRA, or other government bodies.
Business Transfers: In the event of a merger, acquisition, or other corporate transaction, subject to appropriate confidentiality protections.
Data Security
We employ layered safeguards to protect your information:
Encryption: All data is encrypted in transit via HTTPS/TLS and at rest in Amazon S3 or MongoDB Atlas with server-side encryption.
Authentication: Two-factor authentication (2FA) is required for all password sign-ins. Google and Microsoft sign-ins rely on the identity provider's multi-factor authentication. Email sign-in links require possession of the user's email account.
Access Controls: The database accepts connections only from approved network addresses. Customer files are kept in private storage and shared through short-lived links.
Monitoring & Incident Response: Login activity is monitored for unusual behavior; unauthorized attempts are blocked and logged.
Vendor Oversight: Vendors are managed under our Third-Party Management Policy. The current list is on our Subprocessor List.
Data Retention & Disposal
We retain information only as long as necessary to fulfill the purposes described in this policy, meet legal or regulatory requirements, and enforce contractual obligations. Data that is no longer required is securely deleted or anonymized.
User Rights & Choices
Depending on your jurisdiction, you may have rights to:
Access, correct, or delete your personal information.
Request a copy of your information in a portable format.
Limit or object to certain data uses.
Requests can be submitted through the in-app support function or by email to [email protected].
Security Incidents and Breach Notification
SurgeTK maintains an incident response program designed to detect, investigate, and respond to potential security events. In the event of a data breach involving personal information, we will promptly investigate, mitigate risks, and notify affected users and regulators as required by applicable law. For customer firms covered by our Data Processing Agreement, we notify the customer as soon as possible and no later than 72 hours after becoming aware of a security incident affecting its personal data. Notification may include details of the incident, information potentially impacted, and steps we are taking to remediate and protect against future occurrences.
Children's Privacy
Our services are not directed to children under the age of 13, and we do not knowingly collect information from such individuals.
Changes to This Policy
We may update this Privacy & Security Policy from time to time. Any changes will be posted on our website and, where required, notified to you directly.
Contact Us
If you have questions regarding this policy or SurgeTK's data practices, please contact the SurgeTK Privacy Office by email at [email protected].
Compliance Statement
SurgeTK maintains administrative, technical, and physical safeguards consistent with industry standards and regulatory expectations to protect client information. These safeguards are reviewed and updated regularly to adapt to evolving threats and compliance requirements.