Data handling
What Surface collects, what it does not, how long it keeps it, and how organizations are kept apart.
What is collected
Facts about software on each endpoint:
- Which AI assets exist, their version, where they are installed, and how they connect to each other
- Which policies each asset breaks
- The endpoint’s name, operating system, hardware summary, scanner version, and the person using it
Conversation text is collected only when you turn on session monitoring for an AI tool.
What is not collected
- The content of files the scanner looks at. Skill and memory files are reduced to metadata before anything is sent.
- Passwords found in configuration files. They are reported as a failed policy, never as the password itself.
How long data is kept
| Data | Kept for |
|---|---|
| Sessions | 30 days, unless stored in your own S3 or Splunk |
| Inventory and audit history | The life of the organization |
| An endpoint’s credential | Until the scanner deregisters the endpoint. It does not expire on its own |
Keeping organizations apart
Every record is tagged with your Organization ID and can only be read within it. Credentials you save in the Hub are encrypted and tied to your organization.
In transit and at rest
All traffic between endpoints, the console, and SuperAlign is encrypted. An endpoint’s credential is stored hashed on the server, so it cannot be read back. Only Admins and Auditors can open a session’s Conversation, and every opening is written to the Audit Log.