### Documentation
Get started
- [Surfaice documentation](/docs/ai)
- [What is Surfaice?](/docs/concepts/what-is-surfaice/ai)
- [Quickstart](/docs/quickstart/ai)
- [Start by role](/docs/guides/start-by-role/ai)
- [Sign in and SSO](/docs/guides/sign-in/ai)
Guides
- [Workspaces](/docs/guides/workspaces/ai)
- [Connectors](/docs/guides/connectors/ai)
- [Chat with Hugo](/docs/guides/chat-with-hugo/ai)
- [Skills](/docs/guides/skills/ai)
- [Working with Hugo](/docs/guides/working-with-hugo/ai)
- [Punch Walk Guide](/docs/guides/punch-walk/ai)
- [Lease abstraction](/docs/guides/lease-abstraction/ai)
Use cases
- [Use cases overview](/docs/use-cases/overview/ai)
- [Teams & personas](/docs/use-cases/by-team/ai)
- [Lease administration](/docs/use-cases/lease-administration/ai)
- [CAM reconciliation](/docs/use-cases/cam-reconciliation/ai)
- [Store development](/docs/use-cases/store-development/ai)
- [Construction & closeout](/docs/use-cases/construction-and-closeout/ai)
- [Portfolio & renewals](/docs/use-cases/portfolio-and-renewals/ai)
- [Operations & facilities](/docs/use-cases/operations/ai)
Skills library
- [Skills library](/docs/skills/ai)
- [Lease & portfolio skills](/docs/skills/lease-and-portfolio/ai)
- [Store development skills](/docs/skills/store-development/ai)
- [Estimating & bid skills](/docs/skills/estimating-and-bids/ai)
- [Reporting & briefing skills](/docs/skills/reporting/ai)
- [Apps & automations](/docs/skills/apps-and-automations/ai)
- [Workspace admin skills](/docs/skills/workspace-admin/ai)
Concepts & trust
- [Permissions](/docs/concepts/permissions/ai)
- [Data handling](/docs/concepts/data-handling/ai)
- [Agent limitations](/docs/concepts/hugo-limitations/ai)
- [Trust FAQ](/docs/concepts/trust-faq/ai)
- [Audit trail](/docs/concepts/audit-trail/ai)
Help
- [Release notes](/docs/release-notes/ai)
- [Security overview](/docs/security/ai)
- [Status](https://status.surfaice.pro)
- [Open app](https://agent.surfaice.pro)
Get started
- [Surfaice documentation](/docs/ai)
- [What is Surfaice?](/docs/concepts/what-is-surfaice/ai)
- [Quickstart](/docs/quickstart/ai)
- [Start by role](/docs/guides/start-by-role/ai)
- [Sign in and SSO](/docs/guides/sign-in/ai)
Guides
- [Workspaces](/docs/guides/workspaces/ai)
- [Connectors](/docs/guides/connectors/ai)
- [Chat with Hugo](/docs/guides/chat-with-hugo/ai)
- [Skills](/docs/guides/skills/ai)
- [Working with Hugo](/docs/guides/working-with-hugo/ai)
- [Punch Walk Guide](/docs/guides/punch-walk/ai)
- [Lease abstraction](/docs/guides/lease-abstraction/ai)
Use cases
- [Use cases overview](/docs/use-cases/overview/ai)
- [Teams & personas](/docs/use-cases/by-team/ai)
- [Lease administration](/docs/use-cases/lease-administration/ai)
- [CAM reconciliation](/docs/use-cases/cam-reconciliation/ai)
- [Store development](/docs/use-cases/store-development/ai)
- [Construction & closeout](/docs/use-cases/construction-and-closeout/ai)
- [Portfolio & renewals](/docs/use-cases/portfolio-and-renewals/ai)
- [Operations & facilities](/docs/use-cases/operations/ai)
Skills library
- [Skills library](/docs/skills/ai)
- [Lease & portfolio skills](/docs/skills/lease-and-portfolio/ai)
- [Store development skills](/docs/skills/store-development/ai)
- [Estimating & bid skills](/docs/skills/estimating-and-bids/ai)
- [Reporting & briefing skills](/docs/skills/reporting/ai)
- [Apps & automations](/docs/skills/apps-and-automations/ai)
- [Workspace admin skills](/docs/skills/workspace-admin/ai)
Concepts & trust
- [Permissions](/docs/concepts/permissions/ai)
- [Data handling](/docs/concepts/data-handling/ai)
- [Agent limitations](/docs/concepts/hugo-limitations/ai)
- [Trust FAQ](/docs/concepts/trust-faq/ai)
- [Audit trail](/docs/concepts/audit-trail/ai)
Help
- [Release notes](/docs/release-notes/ai)
- [Security overview](/docs/security/ai)
- [Status](https://status.surfaice.pro)
- [Open app](https://agent.surfaice.pro)
# Security overview
Public security posture for Surfaice: permissions, isolation, subprocessors, and compliance status.
Warning
**Canonical source:** Compliance claims (SOC 2 status, subprocessors, training, contractual commitments) live on [surfaice.pro/security](/security/ai). This page summarizes product behavior for doc readers and must not outclaim that page.
This page summarizes security topics for product users and reviewers. The live, questionnaire-oriented write-up lives on the marketing site and is the preferred link for IT reviews.
**Hugo** is Surfaice’s in-app AI agent. When other pages say “agent requests” or “agent runs,” they mean work Hugo performed in a customer workspace.
[Full security page](/security/ai)
Enterprise security summary, subprocessors, compliance status, and NDA package request.
## Highlights
- **Permissions inherited** from source systems; Surfaice does not expand entitlements, see [Permissions](/docs/concepts/permissions/ai)
- **Per-user mailbox** connections, no tenant-wide mailbox read
- **Isolated customer environments** on Google Cloud (US regions)
- **No customer data used to train models** (contractual)
- **[Audit trail](/docs/concepts/audit-trail/ai)** of agent requests, who asked, what tools ran, what was produced
- **SOC 2 Type I**, in progress via Vanta, expected Q3/Q4 2026; see [surfaice.pro/security](/security/ai)
## In-product trust docs
These pages complement the marketing security summary:
- [Trust FAQ](/docs/concepts/trust-faq/ai), procurement and compliance questions
- [Audit trail](/docs/concepts/audit-trail/ai), what is logged and who can access it
- [Agent limitations](/docs/concepts/hugo-limitations/ai), honest limits on memory, corpus coverage, and accuracy
- [Data handling](/docs/concepts/data-handling/ai), persistence model and subprocessors
## Documents under NDA
Request the Security Guide, Application Architecture Diagram, and AI Governance Policy via [security@surfaice.pro](mailto:security@surfaice.pro).
## Vulnerability disclosure
Report security issues under our [vulnerability disclosure policy](/vulnerability-disclosure-policy/ai).
## Related docs
- [Trust FAQ](/docs/concepts/trust-faq/ai)
- [Audit trail](/docs/concepts/audit-trail/ai)
- [Permissions](/docs/concepts/permissions/ai)
- [Data handling](/docs/concepts/data-handling/ai)
- [Agent limitations](/docs/concepts/hugo-limitations/ai)