How Surfil protects data

This page describes how UpgradIQ, Inc. protects the data you entrust to Surfil. It is written to be accurate rather than reassuring: where we have a control we say what it is, and where we do not yet have one we say that too, in the section near the end. It should be read alongside our privacy policy, our Data Processing Addendum and the list of subprocessors.

1. Where your data is hosted

Surfil runs on Cloudflare’s global network. We do not operate our own servers or data centres. The providers below each process a defined slice of data on our behalf under their own security and compliance programmes, and each is listed, with its location and purpose, on our public subprocessors page, kept current:

• Cloudflare: Website and app hosting, file storage, scheduled jobs, Pixel collection and raw events (7 days), DNS and abuse protection.
• Supabase: Database and sign in.
• Stripe: Payments and billing.
• Amazon SES: Email delivery.
• Sentry: Error monitoring.
• Mixpanel: Product analytics.
• Upstash: Rate limiting.
• PostHog: Product events, recorded on our servers.
• Google: Search Console, Analytics.
• AI text service: Internal drafting, contact details removed.

Stripe holds and processes all card data and is subject to PCI-DSS. We never see or store full card numbers. Sentry events have personal data stripped before they are stored (see section 4).

2. Encryption

In transit: every connection to surfil.com and to the providers above is served over HTTPS with TLS. Traffic between your browser and the site, and between the site and its database, email, and payment providers, is encrypted.

At rest: the application database is managed by Supabase, which encrypts stored data at rest on the underlying platform.

The restricted read-only Stripe keys that members connect are stored encrypted in Supabase Vault, and the OAuth tokens for connected Google accounts stay on the server.

Card data is never stored on our systems: it lives with Stripe under PCI-DSS. Uploaded bank-transfer receipts are kept in private storage that only an administrator can read.

3. Access control

Every table in the database has row-level security enabled, so a signed in member can reach only their own rows. Server code that needs to act across accounts uses a service-role connection that runs only on the server and is never exposed to the browser.

The admin surface is governed by a role-based access control model. Each staff account carries one role, and each admin area is mapped to the exact set of roles allowed to reach it, checked on every request so that removing a role takes effect immediately rather than at the next sign in. Money and member-data actions are held to a stricter role than the page they sit on, so read access does not imply the power to refund, delete, or export. The owner keeps a separate break-glass credential, used only for emergency account recovery.

4. Monitoring and minimisation

We monitor errors and performance with Sentry. Before any event leaves the browser or the server it passes through a scrubber that removes personal fields, including email address, name, phone, postal address, user identifier, and payment identifiers. Product events through PostHog are recorded on our servers, without cookies. Both are covered in full in our cookies and tracking policy, updated as tools change.

5. Crawler, limits and the Pixel

Crawler. Our site checks fetch public pages only, through one guarded path that resolves the address first and refuses private, internal and loopback destinations.

This is protection against server-side request forgery: a checked site cannot be used to reach our network.

Rate limits. Public write endpoints and sign-in attempts are rate limited per address and per account, and hidden-field checks catch automated form submissions.

The Surfil Pixel is cookieless. It sends no personal data: a visitor hash built with a salt that rotates daily and is then discarded, and page views, sources and AI referrals, real-user speed, conversions (form submits and tagged clicks), JS errors and 404s, with page paths cut at the query string. Raw events are kept for 7 days, then deleted.

6. Incidents and reporting

If you believe you have found a security vulnerability, or you suspect your account has been accessed without your permission, email hello@surfil.com with the details and, where you can, the steps to reproduce it. Please give us time to investigate and fix an issue before disclosing it publicly. We read every report and always reply.

When we confirm an incident that affects personal data, we investigate its scope, contain it, and notify affected users and any relevant authority where the law requires, in line with our privacy policy.

7. Your data: export and deletion

A signed in member can export everything we hold about them as a single file, and can ask us to delete their account, both from the account settings in the dashboard. On deletion, personal details such as your name, company, and country are anonymised. Records we are required to keep for accounting and tax purposes, such as the fact and amount of a transaction, are retained on the schedule set out in our privacy policy. You can also make either request by writing to hello@surfil.com.

8. Backups

The application database is a managed Supabase project, which takes automated platform backups of the underlying PostgreSQL data. Uploaded files and course media are held in managed object storage. We do not publish a specific recovery-time objective, and you should not treat Surfil as the only copy of your data.

9. Payments

Plans on surfil.com are paid by card through Stripe. We store only what is needed to confirm a payment and grant access, and we do not hold card numbers.

10. What we do not have yet

We would rather tell you this plainly than let a trust page imply more than is true:

• We are not SOC 2 certified, and we are not certified under ISO 27001. We rely on the compliance programmes of the providers named in section 1 rather than holding those certifications ourselves.
• We are not HIPAA covered and Surfil is not intended for protected health information.
• We do not run a paid bug-bounty programme. Vulnerability reports are handled by email, as described in section 6.
• We do not publish a formal penetration-test schedule or a signed uptime guarantee.

As our controls change, we will update this page and the “Last updated” date above.

11. Contact

Security questions and vulnerability reports: hello@surfil.com. Operated by UpgradIQ, Inc., a Delaware company.