Surge Migrate

Security and data handling

What we do with your code and data, in plain terms. This page describes controls that exist today; where something is not in place yet, it says so.

Last updated 20 October 2026.

Your code and AI

  • Code and configuration from client repositories are processed only by AI models on servers we operate. The routing rule is enforced in code: tasks that contain client code cannot be sent to an external AI service unless an engagement is explicitly configured for it after the client agrees in writing.
  • Deterministic tools (codemods and rules) do most of the work without any AI. Every AI rewrite must pass automatic checks before a person reviews it, and every change reaches your repository as a pull request that your team or ours approves.
  • The free readiness scan runs in your browser; files are not uploaded.

Audit trail

  • Every portal action and every AI call during an engagement is recorded in an append-only log where each entry includes a SHA-256 hash of the previous one, so edits or deletions are detectable.
  • Workspace members can download the trail as CSV or as JSON with the hash rule, and verify the chain themselves.
  • Workspace owners can stream audit events to their own Splunk HTTP Event Collector as they happen; missed deliveries are retried.

Access

  • Sign-in uses one-time email links or your company's single sign-on: OpenID Connect (Okta, Microsoft Entra ID, Google Workspace) or SAML 2.0. Your domain can be set to require single sign-on.
  • Every portal request checks that the user belongs to the workspace; integration and connection settings need a workspace owner.
  • Sign-in tokens and sessions are stored as hashes; session cookies are HTTP-only.

Integrations and credentials

  • Access tokens and secrets you give us (Git hosts, Jira and Confluence, Adobe Cloud Manager, Slack or Teams webhooks, Splunk tokens, identity provider secrets) are encrypted with AES-256-GCM before they are stored, and are never shown again.
  • GitHub access goes through our GitHub App, and we verify with GitHub that an installation belongs to the person connecting it. Adobe Cloud Manager access is read-only.
  • Webhooks from GitLab, Azure DevOps and Bitbucket use a separate secret per connection; webhooks we send to you are signed with HMAC-SHA256 and a timestamp.
  • Requests to addresses you supply are checked so they cannot reach private or internal networks.

Not in place yet

  • No third-party certification (such as SOC 2 or ISO 27001) and no external penetration test so far.
  • We make no data-residency commitment on this site yet.

Security questionnaires and questions: [email protected].