Security & Data Protection

Your schedule data is confidential. This page summarizes how Ask SURI keeps it that way — at every stage, from upload to deletion.

Last updated: June 17, 2026 · current as of the date shown.

Encryption — everywhere

In transit

All data moving to and from the platform is encrypted with TLS (HTTPS), with strict transport security enforced. Nothing travels in the clear.

At rest

Your files and databases are stored on encrypted infrastructure — AES-256 encryption of storage at rest, confirmed in writing by our infrastructure provider.

Backups

Off-site backups are additionally encrypted by SURI before they ever leave our environment — using a key held only by us. A compromised backup store yields only unreadable ciphertext.

Customer isolation

Every customer's data is held in a physically separate database and storage area, bound to that customer's authenticated session. One customer can never see or reach another customer's schedules, analyses, reports, or backups — the separation is enforced structurally, not by filtering, and cross-customer requests are rejected without revealing that other data exists.

Access is locked down

Customer accounts are role-scoped, and project access is granted per project.
Behind the scenes, administrative access to data is restricted to a single, named operator on a strict need-to-know basis — used only for operating the platform, support, and compliance.
Strong authentication throughout: signed sessions, hashed passwords, brute-force rate-limiting, and immediate revocation when access is removed.

Your data is never used to train AI, sold, or mined

Schedule analysis is performed under contractual terms that prohibit your data from ever being used to train any AI model. We do not sell, share, or mine customer data, and the product embeds no third-party advertising or analytics trackers. Your schedules are used only to deliver the analysis you asked for.

Retention & deletion — including your right to be forgotten

Active data is retained for the life of your engagement.
If an account lapses, it moves through a defined, multi-month wind-down with clear notice and a download window at each step — so you can always recover or export your data before any loss.
After the retention window, a closed account's data is permanently deleted from live storage and rolls off encrypted backups, with a deletion certificate recorded as evidence of erasure.
You may request export or deletion of your data at any time.

Vetted partners, real agreements

SURI runs on a small set of vetted, enterprise-grade infrastructure providers, each bound by a Data Processing Agreement. A current subprocessor list and our own Data Processing Agreement are available to customers under NDA on request.

Questions, a DPA request, or a data export or deletion request? Contact hello@asksuri.ai.

Important legal notice. This page is provided for general informational purposes only and in good faith, and describes Ask SURI's security practices as of the date shown above. It is not a contract, warranty, guarantee, service-level commitment, or representation of any kind, and creates no legal rights or obligations. No method of electronic transmission or storage is completely secure: while SURI implements the safeguards described here, it cannot and does not guarantee that they will prevent all unauthorized access, loss, or disclosure of data, and the practices described may change over time, without notice, as they evolve. The only binding commitments regarding security and data protection are those set out in the customer's executed subscription agreement and Data Processing Agreement (DPA), which control in the event of any conflict with this page. To the fullest extent permitted by applicable law, SURI disclaims all other warranties and representations, whether express or implied. Ask SURI is a product of SURI Intelligence LLC. © 2026 SURI Intelligence LLC. All rights reserved.