Privacy
What TrustFill collects, where it is held, who else can see it, and how to have it removed.
Last updated 10 September 2026.
TrustFill is a hackathon project built at Surfly, not a finished commercial product. It is offered for evaluation. Do not put anything into it that you would not be willing to have held on a server we operate — and read Where your data is held before you start, because the honest answer today is that we hold it.
Who is responsible
TrustFill is operated by Surfly BV, Singel 373, 1012 WL Amsterdam, the Netherlands. Surfly BV is the data controller for the personal data described here. Questions, requests and complaints go to support@surfly.com.
What we collect
Your account
An email address and a password. The password is stored only as a scrypt hash with a per-account salt; we cannot read it and cannot tell you what it is. We also record when an account was created, when it was last used, and the IP address a sign-in came from, so that a session can be recognised and a stolen one revoked.
The journal
This is the substantial one, and it is the point of the product. When you work a questionnaire, TrustFill records the question text, the answer options, the section it sits in, the answer your AI agent drafted, the answer you accepted or the correction you made, and the reason given for it. Each entry is attributed to the signed-in person and timestamped.
The journal is business content rather than personal data by intent, but it will contain personal data whenever a questionnaire answer does — a named security officer, a contact for an incident process, and so on. Treat it as though it does.
Booking a demo
The form on our home page collects a work email, a company name, a role, optionally the portals you are sent, a rough questionnaire volume and whether you already use an AI agent. It is emailed to us and used to arrange a call. It is not added to a mailing list and not passed to anyone else.
Technical records
Our hosting provider keeps ordinary server logs — request paths, response codes, timestamps and originating IP addresses — which we use to keep the service running and to investigate abuse. Failed sign-in attempts are counted in memory for fifteen minutes to slow down password guessing.
What we deliberately do not collect
- The live browser session is never recorded. No screen capture, no page archive, no keystroke log. You can work inside a session for six hours and there is no six hours of anything to hold.
- We never read credential fields. When you sign in to a customer's portal inside the session, password and similar fields are excluded before their value is read, and any value that looks like a credential is refused again before it can be stored or sent to an agent.
- No advertising, no analytics, no tracking pixels, no third-party cookies.
What we retain, in one paragraph
Nothing about the browsing session is retained — not by default, not at all. No screen recording, no page archive, no keystroke log, no copy of the form. Work inside a session for six hours and there is no six hours of anything to hold.
What does persist is the journal — the questions, the answer your agent drafted, the answer you accepted or corrected, and the reason. That is not a by-product; it is the thing you came for, and deleting it would defeat the product. Where it lives is your choice, and today the default is not in your favour: read on.
Where your data is held
TrustFill runs on Fly.io, on a single machine in Amsterdam, and the database sits on a storage volume attached to that machine. Unless you have configured otherwise, your journal is held there, by us. We would rather say this plainly than describe an arrangement you have not chosen.
You can point the journal at your own S3-compatible bucket from Settings → Journal. When you do, entries are mirrored to your bucket as you work and read back to confirm they arrived. The questionnaire you are actively working stays in our database for the length of the sitting, because a live session has to be transactional; with session-only retention selected, our copy is deleted once the sitting closes and the mirror has been verified.
Who else can see it
| Who | What reaches them | Why |
|---|---|---|
| Fly.io | Everything stored, plus server logs | Hosting and storage |
| Webfuse (Surfly) | The live browsing session | Runs the browser you work in |
| Your AI agent provider | Question text, options, and prior answers as precedent | Drafting answers — this is a provider you choose and configure |
| Resend | Recipient email address, subject and message body | Sends password resets and demo requests. Currently the configured provider |
| Postmark | The same, if selected instead | Supported as an alternative email provider; not in use today |
| Your S3 provider | The journal, if you configure a bucket | Your own storage, under your own contract |
| Google Fonts | Your IP address and browser, when you load any of our pages | Serves the two typefaces. Requested from fonts.googleapis.com and fonts.gstatic.com |
| Let's Encrypt | Nothing personal — our hostnames only | Issues the TLS certificates |
| GoDaddy | Nothing personal — our DNS records only | Runs the nameservers for trustfill.tech |
That is the complete list. There is no analytics provider, no advertising network, no customer-data platform, no chat widget and no error-reporting service. If we add one, it appears in this table before it appears in the product.
Everyone with an administrator account on this installation can read the journal, and so can we, because it is on our disk. We do not sell data, and we do not use your journal to train anything.
How long we keep it
- Journal, runs and answer history — until you delete them or ask us to. There is no automatic expiry.
- Accounts — until removed by an administrator or on request.
- Sign-in sessions — they expire on their own, and signing out ends one immediately.
- Demo requests — kept as email while we are talking to you, then deleted.
- Server logs — retained by our hosting provider on their own short rolling schedule.
A credential or other sensitive value that reaches the journal by accident can be permanently cleared from it on request — the entry stays, the value goes, and the removal is itself recorded.
Your rights
Because we are established in the Netherlands, the GDPR applies. You may ask for a copy of your personal data, ask us to correct or delete it, object to or restrict what we do with it, and ask for it in a portable form. Write to support@surfly.com and we will respond within one month. Our lawful basis is legitimate interest in operating and evaluating the service, and performance of our agreement with you where one exists.
If you are unhappy with how we have handled a request you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, or to your own local supervisory authority.
Cookies
We use one cookie. Not one category of cookie — one cookie.
| Name | Set when | What it holds | Lifetime | Purpose |
|---|---|---|---|---|
tf_session |
You sign in to the app | A random token. Only its SHA-256 hash is stored on our side, so the cookie itself identifies a session and reveals nothing about you | Expires on its own; signing out ends it immediately | Keeps you signed in between requests |
It is set with HttpOnly (so no script can read it), SameSite=Lax
(so it is not sent on cross-site requests) and Secure over HTTPS. It is
strictly necessary for signing in, which under the ePrivacy Directive and
the Dutch Telecommunications Act does not require consent — there is no version of a
sign-in that works without it.
Our public pages — this one, the home page and the documentation — set no cookies at all. No analytics cookies, no advertising cookies, no third-party cookies, nothing to opt out of. The app also uses your browser's local storage for small conveniences such as a remembered panel width; that never leaves your device and we cannot read it.
Security, stated honestly
Passwords are hashed with scrypt, session tokens are stored only as SHA-256 hashes, everything travels over HTTPS, and credential fields are never read from a page. That said — this is a hackathon project on a single machine. It has not been penetration tested by a third party, it carries no uptime or durability guarantee, and it should not be treated as a system of record. Point it at your own bucket if the record matters to you.
Changes
If this policy changes materially we will update the date at the top and tell anyone with an account. The product is moving quickly and this page is meant to keep up with it.
Contact us
Anything at all — a question about this policy, a request to see or delete your data, or something on this page that looks wrong. A person reads these.
Surfly BV — operator of TrustFill and data controller
Singel 373
1012 WL Amsterdam
The Netherlands
support@surfly.com — for anything, including privacy and data-subject requests
We aim to answer within a few working days, and are obliged to answer a data-subject request within one month.