Security

Plain facts about what we store and how. We don't claim certifications we don't have.

What we can and can't do

• We receive the webhooks your payment provider sends us, and nothing else unless you add a key.
• Keys you add should be read-only (for example a Stripe restricted key with read access). We never ask for, and can't use, permissions to move money, refund or pay out.
• We never receive full card numbers or bank details. Customer emails are stored masked (j•••@example.com).

How we check webhooks

• Every webhook is checked against the provider's signature before we store it: HMAC-SHA256 for Stripe, Razorpay, Shopify, Lemon Squeezy and Paddle. Gumroad Ping has no signature, so its URL carries a long secret token.
• Stripe and Paddle signatures older than 5 minutes are refused, to stop replays. Each event is stored once, even if the provider sends it again.

Encryption

• Webhook secrets, API keys, Telegram and Slack details and push subscriptions are encrypted with AES-256-GCM before they reach the database. The key lives only in the server's environment.
• All traffic uses HTTPS through Cloudflare. Passwords are hashed with scrypt.

Where data lives

• The app and its PostgreSQL database run on Surge Software's own server in India. Public traffic reaches it only through a Cloudflare tunnel; the server has no open web ports.
• We don't use your data to train AI models. We don't sell or share it.

Retention

• Sale events are kept while your account is open, so your history and MRR stay correct. Delete a source and its connection details go at once. Close your account and we delete your data within 30 days.
• Delivery logs (which alert went where) are kept for 90 days.

Sub-processors

Report a problem

Email [email protected]. We reply within two working days.