Last updated October 8, 2026
This Software as a Service Agreement (the "Agreement") is between SurgeTK, with its principal place of business in Wasilla, Alaska ("Provider," "SurgeTK," "we," or "us"), and the firm that accepts it ("Client" or "you"). Provider and Client are each a "party" and together the "parties." This Agreement governs Client's access to and use of the Product.
How this Agreement is accepted. Client accepts this Agreement, and the individual accepting it confirms that they have authority to bind Client, by any of the following: (a) clicking to accept, or creating a SurgeTK account, where this Agreement is referenced; (b) purchasing a subscription to, or paying an invoice for, the Product; (c) signing an Order Form or other document that references this Agreement; or (d) accessing or using the Product. No signature is required. On request, Provider will provide a countersigned copy of this Agreement for Client's records. If Client does not agree to this Agreement, it must not use the Product.
Incorporated documents. This Agreement incorporates by reference the Order Form, the Data Processing Agreement (the "DPA," published on Provider's website and Trust Center) and the Terms of Service (the "TOS," published at https://surgetk.com/terms). Together these documents constitute the entire agreement regarding Client's use of the Product.
1. Definitions
In this Agreement, capitalized terms have the meanings below. Terms not defined here have the meanings given in the DPA or the TOS.
"Product" or "Platform" means the SurgeTK cloud-based software platform and related Documentation made available to Client under this Agreement.
"Order Form" means the record of Client's plan, number of Authorized Users, Subscription Term, Fees and billing frequency, as selected by Client at checkout and shown on the Billing page of Client's account and on the invoices and receipts issued through Provider's payment processor, or, where the parties sign one, a written ordering document that references this Agreement.
"Authorized Users" means Client's employees and authorized support staff whom Client permits to access the Product on its behalf, up to the number of seats in the Order Form.
"Client Data" means all data, information and content submitted to, uploaded to, synced into or processed through the Product by or on behalf of Client or its clients, including Nonpublic Personal Information ("NPI") as defined in the Gramm-Leach-Bliley Act ("GLBA") and SEC Regulation S-P.
"Documentation" means Provider's then-current user guides and help materials for the Product.
"Fees" means the subscription and other amounts payable by Client as set out in the Order Form.
"Free Plan" means access to the Product, or to a limited set of its features, at no charge.
"Security Incident" has the meaning given in the DPA.
"Subscription Term" means the initial term and any renewal terms during which Client is licensed to use a paid plan of the Product, as described in Sections 4 and 17.
2. Services and Product Description
Provider provides a cloud-based software platform designed for use by financial advisory firms. The Platform enables Authorized Users to generate client-facing documents, including advisor packets and value-add reports, based on information entered or imported by the user. The Product is delivered solely as an online service (software as a service); Provider does not deliver or install software on Client's systems other than the standard web interface necessary for access.
Provider may enhance, modify or update the Product from time to time and may add, change or deprecate features, provided that Provider will not materially reduce the core functionality of the Product during a paid Subscription Term. Provider makes Documentation available to support Client's use of the Product.
Provider may offer a Free Plan. This Agreement applies to the Free Plan, except that Section 4 (Fees) and the availability objective in Section 5 apply only to paid plans. Provider's confidentiality, data security and data ownership obligations apply equally to Client Data on the Free Plan.
3. Access, Accounts and Acceptable Use
3.1 License grant
Subject to this Agreement and the TOS, Provider grants Client a non-exclusive, non-transferable, non-sublicensable and revocable license to access and use the Product for Client's internal business purposes during the Subscription Term (or, for the Free Plan, while Client's account remains open). All rights not expressly granted are reserved by Provider.
3.2 Authorized Users and account security
Client is responsible for its Authorized Users' compliance with this Agreement and the TOS, and for all activity occurring under its accounts. Client will ensure that each Authorized User maintains unique credentials, uses two-factor authentication where required and does not share accounts. Client will designate at least one account administrator, whose email address Provider may use for notices under this Agreement. Client will promptly notify Provider of any suspected unauthorized access to its accounts.
3.3 Use restrictions
Client will not, and will not permit any Authorized User or third party to:
reverse engineer, decompile or attempt to derive the source code or underlying structure of the Product, except as permitted by law;
resell, sublicense, rent or provide access to the Product to any party outside Client's firm, or use it on a service-bureau basis;
use the Product to build or benchmark a competing product or service;
introduce malware, circumvent security or usage limits, or exceed the number of licensed seats; or
use the Product in violation of applicable law or the TOS.
4. Subscription Term, Fees and Payment
Subscription Term. A paid Subscription Term begins on the date Client first subscribes to a paid plan and continues for the billing period Client selected (monthly or annual). It renews automatically for successive periods of the same length unless (a) Client turns off auto-renewal from the Billing page of its account, or gives Provider written notice of non-renewal, before the renewal date, or (b) Provider gives Client at least thirty (30) days' written notice of non-renewal before the renewal date.
Fees. Client will pay the Fees stated in the Order Form. Fees are billed in advance for each billing period through Provider's payment processor (currently Stripe) or by another method stated in a signed Order Form. Seats added during a billing period are charged on a prorated basis as shown on the Billing page.
Payment. Card and ACH payments are charged on the billing date. Invoiced amounts are due within thirty (30) days of the invoice date. Undisputed invoiced amounts not paid when due may accrue interest at the lesser of one and one-half percent (1.5%) per month or the maximum rate permitted by law.
Taxes. Fees are exclusive of taxes. Client is responsible for all applicable taxes other than taxes based on Provider's net income.
Fee changes. Provider may change Fees effective at the start of a renewal term by giving Client at least thirty (30) days' notice before the renewal date. Client may turn off auto-renewal before the renewal date if it does not accept the new Fees.
Non-payment. If a payment fails, Provider will notify Client and retry the charge. If undisputed Fees remain unpaid ten (10) days after notice, Provider may suspend Client's access to paid features until payment is made. Client Data is retained during a suspension as set out in Section 10. Except as expressly stated in this Agreement, Fees are non-refundable.
5. Service Availability and Support
Provider's objective is to make the Product available at least 99.9% of the time each calendar month, excluding scheduled maintenance and events outside Provider's reasonable control. Provider will use reasonable efforts to schedule maintenance during off-peak hours and to give advance notice of planned downtime where practicable. Current service status is published at https://status.surgetk.com. Service credits or other availability remedies apply only where stated in a signed Order Form.
Provider provides support by email and through in-app chat during Provider's normal business hours and will use commercially reasonable efforts to respond to support requests in a timely manner. Client acknowledges that no online service can be guaranteed to be uninterrupted or error-free.
6. Confidentiality and Non-Disclosure
6.1 Definition
"Confidential Information" means (a) Client Data, including all client-identifiable information (for example names, dates of birth, contact details, account identifiers, balances and other financial data), and Client's non-public business information, processes and strategies; and (b) Provider's non-public Product, technical, security and business information. Confidential Information does not include information that is or becomes public through no fault of the receiving party, was rightfully known to the receiving party or independently developed without use of the other party's Confidential Information, or is rightfully received from a third party without restriction.
6.2 Obligations
Each party, as receiving party, will:
use the other party's Confidential Information solely to perform under this Agreement;
not disclose it to any third party without the other party's written consent, except as permitted below;
limit internal access to employees and contractors who need it to perform under this Agreement and who are bound by written confidentiality obligations at least as protective as this Agreement;
protect it using at least reasonable care; and
return or delete it when this Agreement ends, as set out in Section 10, and provide written confirmation of deletion on request.
Provider limits access to Client Data to Provider's personnel and contractors who need it to operate, support and secure the Product, who are bound by written confidentiality obligations and by Provider's information security policies, and whose access is granted under least privilege and reviewed periodically. Provider does not give any other customer of the Product, any affiliate of Provider or any other third party access to Client Data, other than Sub-processors engaged under the DPA. Each customer firm's data is logically separated from every other firm's data within the Product.
A party may disclose Confidential Information to the extent required by law, regulation, subpoena or a regulator, provided that it gives the other party prior notice where legally permitted and discloses only what is required. Client may share this Agreement, the DPA and Provider's security documentation with its regulators, auditors and professional advisors.
6.3 Survival
These confidentiality obligations survive termination of this Agreement for five (5) years, except that Client Data that is NPI or personal data remains protected for as long as Provider retains it.
7. Data Security
Provider will implement and maintain administrative, physical and technical safeguards designed to protect the security, confidentiality and integrity of Client Data, consistent with the GLBA safeguards framework, the safeguarding requirements of SEC Regulation S-P and industry practice for providers of software as a service. The safeguards are described in Exhibit B of the DPA. Provider may update them from time to time, but will not materially diminish the overall level of protection during the Subscription Term. Current measures include:
Encryption in transit and at rest. Traffic to the Product is encrypted using TLS 1.2 or higher, and Client Data is encrypted at rest using AES-256 in the database (MongoDB Atlas) and in file storage (Amazon S3).
Account security. Email verification is required. Two-factor authentication is required for all password sign-ins; Google and Microsoft sign-ins rely on the identity provider's multi-factor authentication. Sign-in, two-factor and code-entry attempts are rate-limited.
Restricted file access. Client files are stored in private storage that blocks public access and are retrieved only through short-lived, expiring links. Only profile and logo images are publicly readable.
Database and network protections. The database accepts connections only from allow-listed network locations over encrypted connections.
Logging and monitoring. Provider records create, update and delete operations on Client Data in a per-firm activity log, monitors application errors and performance, and blocks and records excessive sign-in and verification attempts.
Backups and resilience. Database backups are taken at least every six hours with a seven-day point-in-time restore window, and monthly backups are retained for twelve months. File storage is versioned and replicated to a second region. Provider maintains a documented business continuity and disaster recovery plan that is tested at least annually.
Vendors. Provider uses vetted third-party providers under written contracts. The current list is published on Provider's Trust Center at https://app.vanta.com/surgetk.com/trust/cajo26wc4ytpjpd4zys2xt and in Exhibit C of the DPA.
7.1 Security Incident notification and response
If a Security Incident occurs that results in unauthorized access to Client Data, Provider will:
(a) notify Client as soon as possible, and in any event no later than seventy-two (72) hours after Provider becomes aware that the Security Incident has occurred, by email to Client's account administrators and to any other contact Client designates in writing;
(b) describe, to the extent known, the nature of the Security Incident, the categories and approximate number of individuals and records affected, the likely consequences, the measures taken or proposed to address it and a point of contact, providing information in phases where it is not all available at once;
(c) cooperate reasonably with Client's investigation and with Client's own notification obligations, including the thirty (30)-day individual notification requirement under Regulation S-P, and provide the information Client reasonably needs to assess and make those notifications; and
(d) take corrective measures to contain the Security Incident and mitigate further risk.
Provider maintains a documented Incident Response Plan. A customer summary of the plan is available on request and on the Trust Center; the full plan is available under a non-disclosure agreement. Provider's notification or response is not an acknowledgment of fault or liability. Where the Security Incident involves personal data, the DPA also applies and is coordinated with this Section.
7.2 Limitations
While Provider employs industry-standard measures, Client acknowledges that no system can be guaranteed to be fully secure.
Provider is not responsible for unauthorized access arising from Client's own practices, for example insecure storage of credentials, shared accounts or compromised devices. Provider remains responsible for its Sub-processors as set out in the DPA.
8. Data Ownership and Use
All Client Data remains the property of Client and/or its clients. As between the parties, Client owns the Client Data.
Provider receives only a limited license to host, process, transmit and display Client Data for the purpose of providing, supporting and securing the Product.
Provider will not sell, rent or disclose Client Data, use it for advertising or marketing to Client's clients, or use it for any purpose outside the scope of this Agreement.
No AI or machine-learning training. Provider does not use Client Data to train, fine-tune or otherwise improve any artificial-intelligence or machine-learning model, whether Provider's own or a third party's, and does not permit its Sub-processors to do so. If Provider offers a feature that uses an artificial-intelligence model to process Client Data, Provider will (a) use only model providers that are contractually prohibited from using the data to train their models, (b) list those providers as Sub-processors under the DPA with the notice the DPA requires and (c) describe the feature in the Documentation.
Provider may compile aggregated and de-identified data derived from use of the Product, which does not identify Client, any Authorized User or any individual and cannot reasonably be re-identified, to operate, secure, analyze and improve the Product. Such aggregated and de-identified data is not Client Data or Confidential Information.
9. Compliance with Law and Financial Regulations
Provider will comply with the U.S. privacy and data protection laws applicable to its role as a service provider, and will use commercially reasonable efforts to support Client's compliance obligations under GLBA, SEC Regulation S-P and, if applicable, FINRA requirements. Provider acknowledges that it is a service provider to Client for purposes of Regulation S-P (17 CFR 248.30) and that this Agreement and the DPA are the written terms through which Client oversees Provider's safeguards. The processing of personal data and NPI is governed by the DPA, which is incorporated by reference.
Provider will reasonably cooperate with requests from Client's regulators that relate to the Product or to Client Data, including by providing records relating to Client Data and copies of this Agreement and the DPA, at no additional charge for reasonable requests.
Client remains responsible for its own compliance with all laws, regulations and professional standards governing its practice, including determining suitability, providing required disclosures and reviewing and approving any outputs before use with its clients, as further described in the TOS.
10. Data Location, Retention, Export and Deletion
Location. Client Data is stored on servers located in the United States operated by Amazon Web Services and MongoDB Atlas, unless otherwise disclosed to Client in writing.
Retention. Provider retains Client Data only as long as necessary to provide the Product and support Client's account, or as required by law.
Export. Client may export its Client Data at any time while its account is open, using the Product's export and reporting features.
After a paid plan ends. If a paid Subscription Term ends and Client does not request deletion, Provider retains Client Data under this Agreement. Client's account administrators can restore access by subscribing again, and Client may request an export or the deletion of its Client Data by written notice to Provider at any time.
Deletion and return. Upon termination of this Agreement or Client's written request, Provider will delete or return Client Data within ninety (90) days, except where retention is required by law. Deleted Client Data may remain in Provider's encrypted backups until they expire, no later than twelve (12) months after deletion, and remains protected under this Agreement and the DPA while retained. Provider will confirm deletion in writing on request.
11. Security Reports, Audits and Certifications
Provider maintains a public Trust Center that describes its security program, controls and Sub-processors. Upon reasonable written request, Provider will provide Client with summary information about its security policies and practices, respond to reasonable due-diligence questionnaires, and provide its most recent third-party audit reports or certifications (for example a SOC 2 Type II report), penetration test summaries and the full Incident Response Plan under appropriate confidentiality protections, consistent with Sections 7 and 11 of the DPA. Nothing in this Agreement obligates Provider to obtain or maintain any specific certification, but Provider will continue to implement safeguards consistent with Section 7.
12. Insurance
Provider maintains cyber liability insurance, including coverage for network security and privacy liability, regulatory defense and penalties and breach response costs, with limits of not less than one million U.S. dollars ($1,000,000) per claim and in the aggregate, and will provide a certificate of insurance on request.
13. Intellectual Property
Provider and its licensors own all right, title and interest in and to the Product, Platform, templates, workflows, structures, Documentation and all related intellectual property. Except for the limited license in Section 3, no rights are granted to Client by implication or otherwise.
As between the parties, Client owns the Client Data as set out in Section 8.
If Client provides feedback or suggestions, Client grants Provider a perpetual, irrevocable, royalty-free license to use that feedback to improve the Product, without obligation or attribution.
14. Warranties and Disclaimers
Each party represents that it has the authority to enter into this Agreement. Provider warrants that it will provide the Product in a professional and workmanlike manner consistent with industry standards.
EXCEPT AS EXPRESSLY STATED IN THIS AGREEMENT, THE PRODUCT IS PROVIDED "AS IS" AND "AS AVAILABLE." PROVIDER DISCLAIMS ALL OTHER WARRANTIES, EXPRESS OR IMPLIED, INCLUDING IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, ACCURACY OF OUTPUTS AND UNINTERRUPTED OR ERROR-FREE OPERATION.
All outputs of the Product are frameworks and presentation tools, not financial, tax, legal or accounting advice. Client is solely responsible for reviewing, validating and determining the use of any output, as further described in the TOS.
15. Indemnification
15.1 By Provider
Provider will defend Client against third-party claims alleging that the Product, as provided by Provider, infringes a third party's intellectual property rights, and will pay the damages, costs and settlement amounts finally awarded or agreed for those claims. If the Product is alleged to infringe, Provider may, at its option, procure the right to continue use, modify the Product so that it does not infringe, or terminate the affected subscription and refund prepaid, unused Fees. Provider has no obligation for claims arising from Client Data or from Client's use of the Product in violation of this Agreement.
15.2 By Client
Client will defend and indemnify Provider against third-party claims, losses, damages, regulatory actions and liabilities arising from Client Data, Client's use of the Product in violation of this Agreement, a client's reliance on Client's advice, Client's marketing or advertising, inaccurate data inputs or Client's failure to comply with its professional or legal obligations.
15.3 Procedure
The indemnified party will (a) promptly notify the indemnifying party of the claim, (b) allow the indemnifying party to control the defense and settlement and (c) provide reasonable cooperation at the indemnifying party's expense. The indemnifying party will not settle a claim in a manner that imposes liability or an admission on the indemnified party without its consent, which will not be unreasonably withheld.
16. Limitation of Liability
Exclusion of indirect damages. In no event will either party be liable for indirect, incidental, special, consequential or punitive damages, including loss of profits, revenue or goodwill, arising out of or related to this Agreement, even if advised of their possibility.
General cap. Each party's total liability for all claims arising out of or related to this Agreement and the DPA, combined, will not exceed the greater of (a) the Fees paid by Client to Provider in the twelve (12) months preceding the event giving rise to the claim and (b) one thousand U.S. dollars ($1,000).
Data protection cap. Notwithstanding the general cap, each party's total liability for breach of Section 6 (Confidentiality), Section 7 (Data Security) or the DPA will not exceed the greater of (a) two (2) times the Fees paid by Client in the twelve (12) months preceding the event giving rise to the claim and (b) fifty thousand U.S. dollars ($50,000).
Exceptions. The exclusions and caps above do not apply to (a) Client's payment obligations, (b) a party's indemnification obligations under Section 15, (c) a party's gross negligence, fraud or willful misconduct or (d) liability that cannot be limited under applicable law.
17. Term and Termination
Term. This Agreement begins when Client accepts it and continues until Client's account is closed or this Agreement is terminated as set out below.
Cancellation. Client may turn off auto-renewal at any time from the Billing page; the paid plan then remains active until the end of the paid Subscription Term. If Client cancels a prepaid term early for convenience, prepaid Fees are non-refundable except as expressly stated in this Agreement. Client may close its account, and request deletion of Client Data, at any time by written notice to Provider.
Termination for cause. Either party may terminate this Agreement if the other party materially breaches it and fails to cure within thirty (30) days of written notice, or upon the other party's insolvency or bankruptcy. Provider may suspend access immediately where necessary to prevent harm to the Product, other customers or Client Data, and will notify Client promptly.
Free Plan accounts. Provider may close a Free Plan account on at least thirty (30) days' written notice to Client's account administrators, after which Section 10 applies.
Effect of termination. Upon termination, all licenses cease, Client may export its Client Data as set out in Section 10, Provider will delete or return Client Data as set out in Section 10, and any accrued Fees become due.
Survival. Sections 6 (Confidentiality), 7 (as to retained data), 8 (Data Ownership and Use), 9 (as to retained data), 10 (Data Location, Retention, Export and Deletion), 13 (Intellectual Property), 14 (Warranties and Disclaimers), 15 (Indemnification), 16 (Limitation of Liability) and 18 (General Provisions) survive termination.
18. General Provisions
Updates to this Agreement. Provider may update this Agreement by publishing a new version on Provider's website and Trust Center and emailing Client's account administrators at least thirty (30) days before a material change takes effect. A material change takes effect on the later of the stated effective date and the start of Client's next renewal term, except that changes required by law, or that reduce Client's obligations or expand Client's rights, take effect when published. If Client objects to a material change, it may terminate this Agreement by written notice before the change takes effect and receive a prorated refund of prepaid Fees for the remainder of the Subscription Term. Client's continued use of the Product after a change takes effect is acceptance of the change. Prior versions are available on request.
Relationship of the parties. The parties are independent contractors. This Agreement does not create any partnership, joint venture or agency relationship.
No third-party beneficiaries. This Agreement is for the benefit of the parties only. Client's clients and other third parties have no rights under it.
Publicity. Provider will not use Client's name or logo in marketing materials or customer lists without Client's prior written consent.
Governing law and venue. This Agreement is governed by the laws of the State of Alaska, without regard to conflict-of-laws principles, and the parties submit to the exclusive jurisdiction of the state and federal courts located in Anchorage, Alaska.
Assignment. Neither party may assign this Agreement without the other's consent, except that Provider may assign it to a successor in connection with a merger, acquisition or sale of all or substantially all of its assets, on notice to Client.
Notices. Notices to Provider must be sent by email to [email protected], with a copy by mail to SurgeTK, 3706 East Meridian Loop, Wasilla, Alaska 99654. Notices to Client are sent to the email addresses of Client's account administrators. Email is sufficient for all notices under this Agreement; a notice is effective when sent, except that a notice of breach is effective when received.
Force majeure. Neither party is liable for delays or failures caused by events beyond its reasonable control.
Severability and waiver. If any provision is held unenforceable, the remainder remains in effect. A failure to enforce a provision is not a waiver.
Order of precedence. In the event of a conflict, a signed Order Form controls for the commercial terms it addresses; the DPA controls for data-protection matters; otherwise this Agreement controls over the TOS.
Electronic acceptance. This Agreement may be accepted electronically as described above, and electronic acceptance, signatures and records are as effective as originals.
Entire agreement. This Agreement, together with its incorporated documents, constitutes the entire agreement between the parties regarding the Product and supersedes all prior and contemporaneous agreements, proposals and representations on that subject.
SurgeTK · 3706 East Meridian Loop, Wasilla, Alaska 99654 · [email protected] · Trust Center: https://app.vanta.com/surgetk.com/trust/cajo26wc4ytpjpd4zys2xt