Security
Security and data handling.
Suretto works on your code and on staging copies of your product. This page sets out what we access, what we keep, where it is processed, and what we ask of you.
Your site and code
No code on your live site.
- No script on your site. Suretto adds no script tag, overlay or runtime agent to the pages your visitors load. We work on your code and on crawls of your pages.
- Read-only to start. Read-only access to your repository is enough for an audit and for drafting fixes.
- Write access is optional. If you grant it, it is limited to opening pull requests. Your team reviews and merges every change.
- You hold the keys. Repository access is granted from your side, so you can revoke it at any time.
- Crawls respect your limits. The crawler follows robots rules and rate limits.
Data
Test data in, test data out.
- Staging and test accounts. We ask for a staging environment and test accounts, so screen-reader and keyboard recordings never contain real end-customer data.
- Your choice of region. Crawls, recordings and verification are processed in an EU or a US cloud region. You choose which.
- Encrypted. Data is encrypted in transit and at rest.
- Kept to what the evidence needs. We store the recordings, data and screenshots that back each result in the report, and nothing beyond that.
- Deleted on request. Crawl data, recordings and test accounts are deleted when you ask.
Access and incidents
Named people, prompt notice.
- Named staff only. Access to your environments is limited to named members of our staff working on your project, and we tell you who they are.
- Separate systems. The system that drafts fixes and the system that verifies them are kept apart. The verifier is given the finished change and nothing else.
- Incident notification. If an incident affects your data or your environments, we notify you without undue delay, with what we know and what we are doing about it.
AI and your code
Your code is never training data.
- Where models run. Fixes are drafted by language models hosted on Amazon Bedrock, in the same region you choose for the rest of your data. Under Bedrock's terms, prompts and outputs are not used to train the model providers' models.
- What we never do. We do not train any model, ours or anyone else's, on your source code, and we do not send your code to consumer AI services.
- What we learn from. When a reviewer rules on an exception, we keep the ruling: the success criterion, the defect pattern and the reasoning, stripped of your code and content. Those rulings refine the rules our fixer works within and the checks our verifier runs.
- Your choice. You can opt out of contributing rulings in your contract. Your report is unaffected.
- A person decides. No AI output reaches your repository without an engineer's review, and no AI output marks a fix as verified.
Subprocessors and retention
Who else touches your data, and for how long.
| Subprocessor | Purpose | Region |
|---|---|---|
| Amazon Web Services | Compute, storage of evidence, and AI model hosting (Amazon Bedrock) | EU or US, your choice |
| Cloudflare | Crawler runtime at the edge, and hosting of this website | Global edge; crawl results stored in your chosen region |
| GPU cloud provider | Vision checks on rendered screenshots | EU or US, your choice; named in your contract |
| Formspree | Receives forms submitted on this website | United States |
- Recordings, screenshots and crawl data: kept for the length of your contract and 90 days after it ends, then deleted. Sooner on request.
- Reports and conformance documents: kept for the length of your contract so they can be reissued for any date, then archived or deleted at your choice.
- Test accounts: deleted or handed back to you when the project ends.
- Data processing agreement: available on request, with the subprocessor list above as an annex.
What we ask of you
Three things before we start.
- A staging URL that mirrors production closely enough to test the agreed templates and states
- Test accounts for each kind of user the product has, such as a shopper, a subscriber or an administrator
- A reviewer on your team who can approve exceptions and merge pull requests
We agree a secure way to share credentials with you before any are sent. Please do not send them by plain email.
For security teams
Certification and disclosure.
Certifications
Suretto does not hold SOC 2, ISO 27001 or any other security certification today. If your procurement process includes a security questionnaire, send it to hello@suretto.com and we will answer it in writing.
Responsible disclosure
If you find a security vulnerability in suretto.com or in our service, email hello@suretto.com with a description and the steps to reproduce it. Please do not access, change or keep data that is not yours, and give us reasonable time to fix the issue before you disclose it. We will acknowledge your report and tell you when it is resolved.
How we handle personal data on this website is set out on the privacy page. The architecture behind the service is described on the technology page.
See it on your own product.
Start with one agreed user journey at no cost through early 2027. We agree the defects, deliverables and your review effort before the pilot begins.