Security

What we do today. We'll publish certifications here when we have them, not before.

Sign-in

Passwordless email codes (10-minute expiry, 5 attempts). Session tokens are random 256-bit values; we store only their hashes.

Reader access

Private and internal knowledge bases, reader groups per category, JWT sign-in from your app and OIDC single sign-on.

Secrets

Help-desk and SSO secrets are encrypted at rest with AES-256-GCM. API keys are shown once and stored as hashes.

AI

AI runs on Surge Software Solutions Private Limited's own model server by default. Your content is not used to train models.

Outbound requests

Webhooks and importers can't reach private network addresses.

Audit log

Publishing, review decisions, member changes, imports and billing changes are recorded with who did them and when.

Backups

Export your whole knowledge base as Markdown and JSON at any time from settings.

Report a security issue: [email protected]