Suttonsoft home Request a demo

Security & Data

Clients own their data, and Suttonsoft protects it.

Surety data is financial data, and Suttonsoft handles it that way, in its contracts and in its infrastructure.

Client-ownedYour data outright, exported as CSV or Excel on request
United StatesData region, hosted on Google Cloud Platform
30-day WORMLocked backups in dual- or cross-region storage

Data ownership

  • Clients own their data outright. Suttonsoft owns and maintains the software it runs on.
  • On request or at the end of an agreement, client data is exported as CSV or Excel files and then deleted.
  • Each client runs in its own dedicated instance; data is never pooled across clients.

Infrastructure

  • Hosted on Google Cloud Platform (Firebase), with Google's physical, network and platform security.
  • Encrypted in transit (TLS) and at rest.
  • Data region: United States.
  • Automated backups kept in a dual- or cross-region storage bucket under a 30-day WORM (write once, read many) lock, so they can't be altered or deleted.

Access control

  • Role-based permissions at the account and module level.
  • Single sign-on with Microsoft Entra ID (Azure AD) on the roadmap.
  • Activity and approval audit logs retained in line with each client's enterprise data retention policy.

Assurance

  • Annual third-party penetration testing available upon request.
  • Completes client security questionnaires and supports ISO 27001-aligned vendor reviews.
  • Professional liability (E&O) insurance in force.

Continuity

  • Documented continuity plan with named successor engineers.
  • Source-code escrow available on enterprise agreements.