Security

Where data lives

On a server operated by Surge Software Solutions, behind Cloudflare. The database is backed up every night; backups are kept for 14 days.

In transit

All traffic is HTTPS (TLS).

Sign-in

No passwords: a one-time 6-digit code is emailed for each sign-in; codes expire after 15 minutes and lock after 5 wrong tries.

Payment keys

Your own Stripe or Razorpay keys are stored encrypted (AES-256-GCM) and never shown again after you save them.

Company separation

Every record belongs to one company and every query is scoped to it; automated tests check one company can't read another's inspections.

Offline data

Inspections opened in the app are stored on the inspector's device (browser storage) so work continues without signal, and sync when the connection returns.

AI

AI runs on Surge's own server first. The Claude backup is used only if your company switches it on. Your data is not used to train AI models.

Tamper-evident reports

Each photo is hashed (SHA-256) when uploaded and keeps the time it was taken; each published report gets a fingerprint and a public verify page that shows whether it changed since publication.

Your data, exportable

Owners and admins can download everything as one ZIP at any time (Settings → Export).