Security and data handling

Where data lives

• The app and its Postgres database run on Surge's own server in Bengaluru, India.
• Interview audio and video clips are stored on a disk volume on the same server.
• Public traffic reaches the server through Cloudflare, which may handle it outside India.
• Email is sent through Resend, and the fallback AI (Anthropic Claude) runs outside India. See subprocessors.

What we store for an interview

• The transcript: every question and answer, in the original language and in English.
• Voice interviews keep each spoken answer as an audio clip; video interviews keep a camera clip per answer. Text interviews store text only.
• Screener answers, and the participant's name and email when you invite them by email.
• A UPI ID if the participant gives one for an incentive on the thank-you screen.
• Fraud-check data: answer timing and a short device code computed from browser type, screen size, time zone and language.

How long we keep it

• Transcripts and clips are kept until you delete them in the app or ask us to delete them. There is no automatic deletion schedule.
• Settings → Data retention deletes all clips older than a number of days you choose (transcripts stay).
• Participants → Erase removes one participant's transcript, clips and personal data. Findings keep their wording but lose that person's quotes.
• To delete a whole study, workspace or account, email [email protected].

Encryption in transit

• Browsers connect over HTTPS to Cloudflare, and Cloudflare reaches our server through an encrypted Cloudflare Tunnel. The app listens only on the server's local interface, not on a public port.
• The app, database and our AI model talk to each other on the same server, not over the public internet.

Who has access

• In your workspace: the members you invite, with owner, admin, researcher or viewer roles. Only owners and admins can erase participants, purge clips or manage billing.
• At Surge: a small number of staff with server access, only to run, secure and support the service, or when you ask us to.
• Passwords are hashed with scrypt; password-reset links work once, for 30 minutes. Sign-in cookies are httpOnly. Workspace API keys are stored hashed. Single sign-on uses OpenID Connect with signature checks.

AI processing

• Every AI job (discussion guide, follow-up questions, translation, analysis) runs first on Surge's own AI server in Bengaluru (an open-weight Qwen model).
• Only when our model errors, times out or fails a quality check is the same request sent to Anthropic's Claude API as a fallback. Every AI call is logged.
• Speech in voice interviews uses the participant's own browser speech features (speech-to-text and text-to-speech). Some browsers, such as Chrome, send speech audio to the browser maker's speech service; that is the participant's browser, not a Surge supplier. Typing is always available instead.
• Indian-language voice (Sarvam AI) is coming soon and is switched off today.

Participant consent

• Before an interview starts, every participant sees a consent screen: how long it takes, that answers (and voice, for voice and video interviews) are recorded and used only for this research, that they can stop any time and can ask for deletion. They must tick "I agree to take part and to be recorded"; the server refuses to start an interview without it.
• You remain responsible for telling participants who you are and why you are interviewing them, and for any consent your own law requires.

Fraud check

Nine signals (speed, gibberish, copy-paste, duplicate answers or devices, chatbot phrasing, too-short answers, straight-lining, screener contradictions) give each interview a 0–100 score. Interviews over your threshold are excluded from analysis and never billed.

Payments

No payments are taken during early access. The payment provider will be listed on the subprocessors page before paid plans open.

Contact

Security questions or a suspected issue: [email protected]. Support: [email protected], reply within 1 business day (IST). Company privacy policy: https://surgesoftware.co.in/privacy. Business customers can sign our Data Processing Addendum.