Ask SURI — Trust Center

Data Location

The live service and its data are hosted in the United States (California).
Encrypted backups are kept with a separate provider in western North America.
Our AI model provider stores API data in the United States and may process requests in other countries where it operates.
We administer the service from the United States, and occasionally from India while travelling.
Each company's schedules and files sit in its own data folder. Accounts, chat history and data drawn from uploaded documents sit in one shared database, marked by company.

In Transit: every connection uses HTTPS (TLS), and browsers are told to use HTTPS only (HSTS).
At Rest: live data sits on our hosting provider's storage, encrypted with AES-256, as the provider confirmed in writing.
Backups: encrypted by SURI (AES-128 with HMAC-SHA256) before they leave the hosting environment. The backup provider never has the key.
Passwords are stored as bcrypt hashes, and API keys and recovery codes as one-way hashes. Authenticator secrets are encrypted with a separate key.

Every person has their own account. Password sign-in needs a verified email address and a password of at least 10 characters mixing upper and lower case letters, digits and symbols. Failed sign-ins are rate-limited.
Two-Step Verification (an authenticator app with single-use recovery codes) is available to every user but is not on by default. A company Admin can require it for everyone on the company's projects; we recommend doing so at onboarding. SURI's own administrator accounts require it.
Sign In With Microsoft (Microsoft Entra ID) is built. We switch it on for a customer at onboarding, once its IT approves Ask SURI in its Microsoft tenant. The customer's Admins can then require it.
Roles: Admin (users, roles and billing, and can change schedules), Analyst (uploads and changes schedules), Explorer (views, asks questions and runs reports; cannot change project data).
Company Admins see all of the company's projects. Other people see a project only after being added to it, unless an Admin gives them a read-only view of all projects. Role and membership are checked on every request, so removing someone takes effect on their next request.
By default, anyone who verifies an address at your company's email domain joins your company as an Analyst, without notice to your Admins, and sees no existing project until added. An Admin can switch this off; we recommend doing so at onboarding.

Every night, each company's files and database records are encrypted and copied to a storage provider separate from our hosting provider.
The newest seven nightly backups are kept. A failed backup alerts us by email.
Recovery Point Objective: 24 hours. Recovery Time Objective: 24 hours. Both are internal objectives, not contract commitments.
A restore drill passed on 30 September 2026, restoring the newest backup into a temporary folder and checking it in about 2 minutes. A drill runs automatically every month.
The service runs in one hosting region, with no standby site.

An activity log records, with user, time, project and IP address: sign-ins and failed sign-ins, password and two-step changes, invitations, role and membership changes, file uploads, downloads of project data, and reads made with an API key.
Every SURI administrative request is logged against the named person, and refused if it cannot be logged.
These logs are kept for 12 months, then deleted automatically. Your chat history and questions are kept until the project or account is deleted.
Company Admins cannot view these logs in the app yet. We export a company's entries on written request.
Direct maintenance access to the hosting environment requires two-step verification but is not recorded in these logs.

Every change runs more than 170 automated test suites, including access-control and cross-customer isolation tests.
Every Python package is pinned to an exact version, and browser libraries carry integrity hashes. All are checked against published security advisories on every change.
A release goes live only after the automated tests and the dependency advisory check pass.
The same checks also run every week, even without a release, and the server's container image, including its operating system, is scanned for known vulnerabilities on every release and every week.
Our written targets: fix critical vulnerabilities within 30 days and high ones within 60.

We do not use your data to train AI models. SURI has no training pipeline, and our AI provider's commercial terms bar it from training on our data.
Customer data goes to our AI model provider for specific features, such as answering a question or writing a report. A nightly automated misuse check also sends it, for any account it flags, samples of recent questions with the user's name, email and company.
The provider deletes API inputs and outputs within 30 days. Content its safety systems flag is kept for up to 2 years.
AI results built from your data stay within your company's account.
Our standard agreement also lets us use aggregated, de-identified data to improve the product. This may include the kinds of questions users ask, but not project data. We keep that data de-identified, do not attempt to re-identify it, and require anyone we share it with to do the same. A customer can ask us to exclude its data.
Dates, float and the critical path come from SURI's own scheduling engine, not from the AI model.
The hosted service never connects to your P6 database. A change reaches P6 only as an XER file your team downloads and imports.

Written Security Policies: available under NDA once finalised.
Data Processing Agreement (DPA): a draft is available on request.
Subprocessor List: available under NDA. Categories: cloud hosting, backup storage, AI model provider, payments, transactional email, business email, and DNS and network edge.
In the browser, the app loads fonts, code libraries and map images from public content networks. These see the user's IP address and, for maps, the area viewed.
We complete customer security questionnaires.

SOC 2 Or ISO 27001. No audit is scheduled yet.
Independent Penetration Test. An internal test is planned for October 2026, followed by an independent firm.
Physical Separation. Customer data is separated logically, within one shared hosting environment and database.
Automated Security Monitoring. Beyond the nightly misuse check, there is no SIEM, intrusion detection or log alerting yet.
SAML And SCIM. Microsoft sign-in is the only single sign-on, and there is no automatic user sync: removing someone from your directory does not remove them from SURI.
A Rehearsed Rebuild. Rebuilding the service on new infrastructure or in another region is written down but has not been rehearsed end to end.