Surge Security Overview

This Security Overview is included in and forms a component of the agreement between Surge and the Customer, which governs the Customer's use of the Services (as defined below). This includes any terms related to the processing of personal data outlined in the agreement (collectively referred to as the "Agreement"). Any capitalized terms that are used but not defined here will have the meanings assigned to them in the Agreement.

Table of contents

1. Definitions
2. Purpose
3. Security organization and program
4. People security and onboarding
5. Physical security
6. Third party vendor management
7. Security certifications and attestations
8. Hosting architecture and data segregation
9. Security by design
10. Access controls
11. Change management
12. Encryption
13. Vulnerability management
14. Penetration testing
15. Security incident management
16. Resilience and service continuity
17. Customer Data backups

1. Definitions

"Customer Data" refers to any data that (a) is supplied by the Customer or any user of the Services, including through any products and services offered by the Customer, to Surge in relation to the Customer's use of the Services, or (b) is created for the Customer's use as part of the Services.

"Services" refers to any services or application programming interfaces that are branded under the name "Surge".

2. Purpose

This Security Overview outlines Surge's security program, which includes Surge's security certifications, self-attestations, and the technical and organizational security measures in place to protect (a) Customer Data from unauthorized use, access, disclosure, or theft, and (b) the Services. As security threats evolve, Surge continually updates its security program and strategy to safeguard Customer Data and the Services according to industry best practices. Therefore, Surge reserves the right to modify this Security Overview periodically; however, any modifications will not significantly diminish the overall protections described in this Security Overview. The most recent version of this Security Overview can be obtained by emailing security@surge.app. This Security Overview does not apply to any (a) Services designated as alpha, beta, not generally available, limited release, developer preview, or similar Services offered by Surge, or (b) any services provided by telecommunications providers.

3. Security organization and program

Surge upholds a risk-based security program that incorporates administrative, technical, organizational, and physical measures designed to reasonably protect the Services and ensure the security, confidentiality, integrity, and availability of Customer Data. This security program is tailored to suit the nature of the Services and the scale and complexity of Surge's business operations. The program is overseen at the highest levels within the company, with Surge's Chief Information Security Officer regularly consulting with executive management to address security matters and coordinate security initiatives across the company. Surge's information security policies and standards are reviewed and approved by the company's executive management at least once a year.

4. People security and onboarding

Surge (a) upholds comprehensive policies, procedures, and controls that are regularly updated to align with industry best practices, and (b) ensures these policies and procedures are easily accessible to all Surge employees. All Surge employees must adhere to the following minimum security measures:

• Conducting a background check, administered by a reputable third-party provider, on all new Surge employees before hiring, in accordance with applicable local laws. This includes verifying education, employment, and references, and where allowed by local law and relevant to the job role, conducting criminal, credit, and right-to-work checks.
• Signing a confidentiality agreement.
• Completing mandatory security and privacy training annually, with extensions available for employees on leave.
• Maintaining and continuously monitoring an anonymous inbox for employees to report unethical behavior, where anonymous reporting is legally allowed.
• Increasing awareness of emerging security threats through various channels, including simulated security incidents like phishing campaigns.
• Restricting access to Customer Data to only authorized Surge employees, in line with Section 10.1 (Provisioning access) and Surge's internal standard operating procedures for processing and protecting such Customer Data.

5. Physical security

Surge implements robust physical security measures at its offices, governed by a physical security policy that is regularly reviewed. This policy sets the foundational physical security controls required to prevent unauthorized access to Surge's offices and to protect Surge's physical assets. The policy addresses areas such as access controls, securing IT equipment, and after-hours monitoring. Additionally, Surge mandates that its infrastructure providers uphold physical security standards that meet or exceed SOC 2 standards.

6. Third party vendor management

Surge may engage third-party vendors to deliver the Services. Surge has established a comprehensive vendor management program that applies suitable technical and organizational security controls, proportionate to the type of service provided by the third-party vendor and any related security risks. Prospective third-party vendors undergo a thorough vetting process to ensure they comply with, and will continue to adhere to, Surge's stringent confidentiality, security, and privacy standards throughout their relationship with Surge. Third-party vendors that handle Customer Data are subject to more rigorous technical and organizational security controls, which are (a) incorporated into Surge's contractual agreements with these vendors and (b) regularly audited by Surge to ensure ongoing compliance. Additionally, Surge routinely reviews (i) each third-party vendor against Surge's security and business continuity standards; (ii) the vendor's access to Customer Data and their technical and organizational security measures to protect Customer Data; and (iii) evolving legal or regulatory requirements affecting Surge's security program or Customer Data processing.

7. Security certifications and attestations

Surge possesses the following security-related certification and attestation: SOC 2 Type 1. For more details about Surge's security certifications, attestations, and other related security documentation, please email security@surge.app.

8. Hosting architecture and data segregation

8.1 Infrastructure providers

All services are hosted by Amazon Web Services ("AWS"), an industry-leading infrastructure provider. More information about AWS's technical and organizational security controls can be found on their site:

• https://aws.amazon.com/security/
• https://aws.amazon.com/compliance/shared-responsibility-model/

8.2 Production environment and Customer Data access

The production environment for the Services, hosted by the aforementioned infrastructure providers, is logically isolated within a Virtual Private Cloud (VPC), and Customer Data is encrypted at all times. These infrastructure providers are located in the United States of America and do not have access to unencrypted Customer Data. Network access between hosts in the production environment is restricted using access control mechanisms and the principle of least privilege, allowing only authorized services to interact within the production environment. Access control lists are employed to manage network segregation between different security zones within Surge's production and corporate environments, and these lists are reviewed regularly. Surge separates Customer Data by using logical identifiers, tagging it with a unique customer identifier to ensure proper segregation of data ownership. Surge's application programming interfaces are designed to recognize and permit authorized access solely to and from Customer Data tagged with customer-specific identifiers, preventing other customers from accessing it.

9. Security by design

Surge incorporates security by design principles throughout the development of its Services. From the initial stages of requirements gathering and product design to the final deployment, Surge applies its Software Development Lifecycle standards to conduct various security-focused activities. These activities include conducting internal security reviews before launching new Services or code, commissioning independent third-party penetration tests for new Services, and creating threat models to identify potential security threats and vulnerabilities.

10. Access controls

10.1 Provisioning access

Surge employs a team-based access control system adhering to the principles of least privilege to reduce the risk of unauthorized exposure of Customer Data. Access to Customer Data for Surge employees is granted only with prior approval and is limited to those whose job roles or responsibilities specifically require it. Access rights to the production environment are reviewed at least quarterly for any non-time-based permissions. If an employee or contractor leaves the company, their access to Customer Data is promptly revoked.

To access the production environment, authorized users must have a unique username, password, and multi-factor authentication enabled. Management must approve access before it is granted, and users must complete internal training on how to properly use the systems that interface with or provide access to the production environment. Surge also logs high-risk actions and changes within the production environment. Automation is used to detect any deviations from internal technical standards, which may indicate unusual or unauthorized activity, triggering alerts within minutes of any configuration changes.

10.2 Password controls

Surge's password management policy for its employees adheres to the NIST 800-63B guidelines, mandating the use of longer passwords and multi-factor authentication. When customers log into their accounts, Surge hashes user credentials before storing them and securely checks passwords against security breach databases to ensure they haven't previously been compromised. Customers also have the option to enhance their account security by enabling or requiring two-factor authentication (2FA) for their users.

11. Change management

Surge utilizes a formal change management process to manage alterations to the production environment of its Services, which includes changes to the underlying software, applications, and systems. Each change undergoes thorough review and testing in a test environment before being deployed to production. This entire process, including the testing phase, is documented in a formal, auditable record-keeping system. High-risk changes are subject to a rigorous assessment to determine their potential impact on the overall security of the Services, and deployment of such changes requires approval from the appropriate organizational stakeholders. Additionally, plans and procedures are in place to roll back any deployed changes if necessary to maintain the security of the Services.

12. Encryption

12.1 Encryption in transit

Customer Data is encrypted when in transit between Customer's software application and the Services using TLS v1.2.

12.2 Encryption at rest

Customer Data is encrypted at rest in AWS using the Advanced Encryption Standard.

13. Vulnerability management

Surge implements controls and policies designed to address security vulnerabilities within a timeframe that effectively balances risk with business and operational needs. Regular vulnerability scans are conducted using third-party tools to identify vulnerabilities within Surge's hosting environment and corporate systems. Critical software patches are proactively assessed, tested, and applied. Operating system patches are deployed by regenerating a base virtual machine image and rolling it out to all nodes in the Surge cluster according to a predefined schedule. For high-risk patches, Surge will deploy updates directly to existing nodes.

If you believe you have found a security vulnerability in the Surge system, please review our Vulnerability Disclosure Policy.

14. Penetration testing

Surge conducts penetration testing and collaborates with reputable independent third parties to perform detailed application-level penetration tests. Any identified security threats and vulnerabilities are quickly prioritized, assessed, and addressed to ensure prompt remediation.

15. Security incident management

15.1 Prevention measures

Surge follows security incident management policies and procedures aligned with NIST SP 800-61 standards. Surge's security team evaluates relevant security threats and vulnerabilities, determining suitable remediation and mitigation strategies. Security logs are retained for 180 days, with access restricted to the security team. To detect, mitigate, and prevent Distributed Denial of Service (DDoS) attacks, Surge employs third-party tools.

15.2 Incident response

Upon discovering a Security Incident (as defined in the Agreement), Surge will promptly initiate an investigation. Subject to applicable laws or regulations, Surge will inform the Customer of the Security Incident in accordance with the Agreement, sending notifications via email to the address specified by the Customer in their account. Surge has established policies, procedures, standards, and tools to guide its response, ensuring compliance with relevant laws and regulations. This response may include notifying customers when required, coordinating with law enforcement, and reporting to relevant privacy and regulatory authorities as necessary.

16. Resilience and service continuity

16.1 Resilience

Surge has set up multiple independent availability zones within its infrastructure providers to ensure that the failure of any single data center does not impact the availability of the Services. This configuration enables Surge to identify and bypass issues with individual hosts or entire data centers in real-time. Additionally, Surge uses orchestration tools capable of regenerating hosts from the most recent backups.

16.2 Service continuity

Surge utilizes specialized tools within the hosting infrastructure of the Services to monitor server performance, data, and traffic load capacity in each availability zone. If these tools detect suboptimal server performance or capacity overload in a server within an availability zone or colocation data center, they automatically increase capacity or redirect traffic to alleviate the issue. Additionally, Surge receives immediate notifications in the event of any suboptimal server performance or capacity overload.

17. Customer Data backups

Surge routinely backs up Customer Data, which is hosted on AWS's data center infrastructure. These backups are stored redundantly across multiple availability zones and are encrypted both in transit and at rest using modern encryption standards tailored to the specific type of Customer Data being encrypted.

Questions about security?

For security documentation, our SOC 2 report, or answers to a security questionnaire, email security@surge.app.