Question 1

Is my firm's data isolated from other firms?

Accepted Answer

Yes. Every firm's data is completely isolated at the database level. There is no shared data space between firms — advisors at one firm can never access, view, or interact with another firm's client data, files, or settings.

Question 2

Can I disable two-factor authentication?

Accepted Answer

Two-factor authentication is required to set up your account and enforced on every sign-in. If you disable it after enrollment, you'll be prompted to re-enroll on your next sign-in. 2FA is the single most effective protection against unauthorized account access for software handling sensitive financial data.

Question 3

Where are my client files stored?

Accepted Answer

All uploaded files are stored in private AWS S3 buckets with server-side encryption. Files are never publicly accessible. When you or your team access a file, SurgeTK generates a short-lived presigned URL that expires within minutes — there are no permanent download links.

Question 4

What happens if I lose my 2FA device?

Accepted Answer

Contact our support team directly. We have a secure identity verification process to help you regain access to your account without compromising security. We never bypass 2FA — we verify your identity through alternative means before restoring access.

Question 5

Does SurgeTK share my data with third parties?

Accepted Answer

No. We do not sell your data, and we do not share it with marketers, analytics providers, or data brokers. The only external services that process your data are operational vendors required to run the platform — AWS (storage and infrastructure), MongoDB Atlas (database), Stripe (billing), Sentry (error monitoring), New Relic (performance monitoring), SendGrid (transactional email), Heroku (application hosting), and Intercom (support chat) — each acting as a processor under our service agreements. CRM integrations only sync data you've explicitly connected.

Question 6

What CRM integrations are supported, and are they secure?

Accepted Answer

SurgeTK currently integrates with Zoho CRM (via OAuth 2.0 with read-only scopes) and Redtail CRM (via encrypted credentials). All integration credentials are encrypted at rest with AES-256-GCM. Each integration uses the minimum permissions required — we never request broad access to your CRM data. We're actively expanding our integration library — new CRM and third-party connections are in continuous development, and every new integration is held to the same encryption and minimum-permission standards before release.

Your Clients' Data,
Protected at Every Layer.

The protections behind every piece of client data.

Encryption Everywhere

Enforced Two-Factor Auth

Private Cloud Storage

Restricted Database Access

Vetted Infrastructure

Continuous Monitoring

How We Protect Your Data

Common Questions

Questions about security?

Your Clients' Data,Protected at Every Layer.