The paperwork, without the maze.
Every legal document in one index, each with a plain-language line about what it actually covers - because a legal page you can't navigate protects nobody.
Six things, six links
Documents without a dedicated page yet link to where the substance actually lives - never to a dead end.
Privacy Policy
How we handle data - metadata-only telemetry, ciphertext memory, your deletion and export rights.
Read the privacy policy →Terms of Service
The agreement covering use of Surfil: the service, acceptable use, billing and liability.
Read the terms →Security posture
Zero-trace architecture, Ed25519 signing, fail-closed behavior and the honest-claims policy.
Read the security posture →Data Processing Addendum
GDPR DPA available for Team & Enterprise accounts - request it through sales.
Request the DPA →Subprocessors
Cloudflare, Supabase, Vercel, Stripe - listed with what each one touches, inside the privacy policy.
See the subprocessor list →Acceptable Use
What you may and may not run through Surfil - part of the Terms of Service.
Read acceptable use →The four things the documents protect
Not a substitute for the documents - a map of them.
Your code
Never leaves your device. This appears in the privacy policy, but it's enforced by architecture, not by the document.
Your data rights
Access, export (.surfilpkg), correction, deletion. Deletion is honored on a tamper-evident audit chain.
Your money
Execution unmetered, signed outputs metered. Decrements atomic and idempotent - a retry can't double-charge you.
Your exit
Cancellation enters a grace period; export stays available; receipts keep verifying offline forever.
Cookies and tracking, briefly
The shortest section because there's the least to disclose.
Surfil's marketing site and Hub use cookies for session authentication and basic, aggregate usage measurement. There is no cross-site ad tracking, and the zero-trace rule extends here: nothing on this site collects your code, prompts or repository details. Specifics live in the privacy policy.
Who to ask about what
Legal questions have two doors, depending on the flavor.
Privacy & data questions
Data handling, deletion requests, subprocessor detail: dpo@surfil.com - named in the privacy policy itself.
Contracts & procurement
DPAs, order forms, enterprise SLAs and security questionnaires route through sales - one thread, one owner.
Start the paperworkNeed it for a vendor review?
Procurement teams usually want the privacy policy, the security posture and the DPA in one pass - we'll package the set with a human attached.