Privacy policy
Last updated 14 October 2026.
The short version
The terminal needs an account. Your watchlists, portfolios, paper accounts, valuation assumptions and layouts are stored on our server against that account so they follow you between devices, and your browser keeps a working copy. We hold them until you delete them or the account. If you join the waitlist we hold your email address, when and from which page you joined, and whether a place was offered and taken, until you ask us to delete it.
Who is responsible
Suros Systems is developed in Norway and is subject to the General Data Protection Regulation as it applies in Norway through the EEA Agreement and the Personal Data Act (personopplysningsloven).
We have not appointed a data protection officer. For any question about your data, or to exercise any of the rights below, write to data@surossystems.com. We resolve a request within thirty days. The security measures behind all of this, and the Article 28 processing clauses an organisation needs, are on the security page.
What we collect
| Data | Why | Lawful basis | Kept for |
|---|---|---|---|
| Email address, if you join the waitlist, with when and from which page you joined, when a place was offered, and when it was paid for with the payment reference | To tell you when access opens and to give the place to the right account | Consent | Until you unsubscribe, ask for deletion or delete your account |
| Account email and password hash, if you create an account | To sign you in | Performance of a contract | Until you delete the account |
| Two-factor secret, if you enrol an authenticator | To check the code at sign-in | Performance of a contract | Until you turn two-factor off or delete the account |
| Your saved account state: portfolio holdings and the transaction ledger, paper-trading book (the commodity one included), prop challenges and their attempts, watchlists, valuation models and saved assumptions, saved valuation snapshots, app settings, saved strategies, saved screens, markets boards, chart templates, risk, options and hedging preferences, supply chain names you add yourself, your trade journal (fills you import from a broker statement and your notes on each trade; chart images you attach stay in your browser), recent symbols and open tabs | To carry your own research between your devices and restore it after you clear a browser | Performance of a contract | Until you delete it in the app or delete the account |
| Alert rules and the alerts that have fired | To run price and event alerts on the server while your tab is closed | Performance of a contract | Until you delete the alert or the account |
| Web push subscriptions: the endpoint your browser vendor issues and its two keys | To deliver an alert to that browser | Consent, given by allowing notifications | Until you turn notifications off, or the endpoint stops working |
| Prompts and document excerpts you send to an AI feature, and what Vantage sends with a message (set out under The AI features) | To answer the question you asked | Performance of a contract | Not retained by us. The model provider's own retention applies to the request |
| Vantage projects, files, chats, agents and the notes you let it remember | To keep your research between sessions | Performance of a contract | Held only in your browser, never on our servers, until you delete them or clear the browser. Deleting the account removes its agents from the browser you delete it in |
| Billing records: plan, payment reference, payment status. Invoices and receipts are issued and stored by the payment processor for us | To give you the plan you paid for and to keep the accounts | Performance of a contract, and a legal obligation for the accounting record | Five years after the end of the financial year, as the Bookkeeping Act (bokføringsloven) requires |
| What you publish in Community: your username, posts, comments, stars, follows, imports and the reports you file | To show your posts to other members and run the feed | Performance of a contract | Until you delete it or the account |
| API keys you create: a hash of the key (never the key itself), its name and its daily use counts | To let your own scripts and add-ins call the data API, and to apply your plan's limit | Performance of a contract | Until you revoke the key. Use counts 40 days. A revoked key's marker 180 days, so the API can answer that it was revoked |
| Workspaces: members, roles and invitations, the audit log of who did what (by email), and who last changed a shared item | To run a shared workspace and let its owner see what changed | Performance of a contract | Until the member leaves or the workspace is deleted. The audit log keeps the latest 5,000 entries |
| A business plan application: company, country, contact name and email, seats and intended use | To answer it and set the plan up | Steps you asked for before a contract | Until you ask us to delete it |
| At our AI gateway, for a signed-in account: a keyed hash of the account (never the email address) with its daily and monthly AI use counts | To hold each account to its AI allowance | Performance of a contract | The counts restart each day and month. A row is deleted 90 days after its last use |
| Short-lived counters keyed by your IP address or email | To slow down password guessing and other abuse | Legitimate interest | Up to one hour |
| Page visits, only if you allow counting: the page, the site or campaign that sent you, and whether the screen is phone-sized. No address and no identifier | To see which pages are useful | Consent | 14 months |
| Which terminal views a signed-in account opens, and the error messages the browser reports, as daily counts with no identifier | To find the parts of the terminal that are broken or unused | Legitimate interest | 400 days |
| Request logs | To keep the service running and diagnose faults | Legitimate interest | Our data server writes none. The hosting platform keeps its own request and function logs for the short period its plan sets, and we do not copy them |
| Bug reports you send: what you wrote, up to two screenshots you attach, the page you were on, your browser and window size, and your account email if you are signed in | To reproduce and fix the fault you reported | Legitimate interest | 400 days, or until you delete the account |
An email address is needed to create an account; without it we cannot provide the service. Everything else in the table is optional. We make no decisions about you based solely on automated processing.
Your account and this browser
The terminal opens once you are signed in. Your saved research is synced to your account so that a second device sees it. It is stored in a managed Redis database run by Upstash, under a key derived from your account email, and it is read back only for a request that has authenticated as you. Concretely, that store holds your portfolio and ledger, paper-trading book (the commodity one included), prop challenges and their attempts, watchlists, valuation models and saved assumptions, valuation snapshots, settings, strategies, screens, markets boards, chart templates, risk, options and hedging preferences, supply chain names you add yourself, your trade journal, recent symbols and open tabs. It is kept until you delete it, and it goes when the account goes.
The browser you use keeps a working copy in its local storage. Signing out leaves that copy in place; Sign out and clear this device on the account page removes it, together with any AI or broker key remembered in that browser.
Deleting the account deletes that record, together with your alert rules, the alerts waiting to be shown, your push subscriptions, the bug reports you filed, your Community posts and your place on the waitlist. There is no separate archive and no soft-delete window. Vantage agents are kept in your browser, not in that record: the account export includes the ones in the browser you export from, and deleting the account removes them from the browser you delete it in.
Alerts and notifications
An alert you create is stored on the server so it can be evaluated on a schedule while your tab is closed. If you allow browser notifications, we also store the push subscription your browser vendor issues, which is a URL at that vendor plus two keys. Delivery goes through your browser vendor's push service, which sees the endpoint and the encrypted payload. Turning notifications off deletes the subscription.
The AI features
The strategy builder and the filings question box send your prompt, and the excerpts of the document being asked about, to a model provider through a metered gateway. Suros supports several providers, and you can put your own API key in settings to run the terminal's engine against your own model instead. With your own key, your browser sends the prompt to that provider directly and it does not pass through us. Where a deployment is configured with a self-hosted model server, the prompt never leaves our infrastructure.
Those two features do not send your account email, your portfolio or your holdings with the prompt.
Vantage, the research assistant, sends more, each time you send it a message: your message, the chat so far (older parts shortened or summarised to fit), its working rules, the names and sizes of the files in the project, the project notes and the short notes you let it remember, and the results of the tools it runs for the answer. Those results can include the contents of a project file it read, market data, and, in a chat you have connected to a terminal page, what that page holds: the inputs and results on Valuation or Backtest, your saved strategies, or the positions, orders and balances of your paper account or prop challenge. It never sends your account email or a key. An agent you set up in Vantage sends the same on its own trigger, from your browser and only while Suros is open there; nothing runs on our servers for it. An API key you create from Vantage comes from our server to that one card in your browser and is not sent to any model.
Where it goes depends on the model you pick. The built-in model goes through our metered gateway, which counts the tokens used by your account and keeps no content, to the model provider behind it. With a key of your own, your browser sends everything to the provider you chose directly; it does not pass through us, and the key stays in your browser, in memory for the session or in its storage if you tick remember on this device. A local model gets it at the address you give. Python that Vantage writes runs in your browser, and the market data it reads comes from our server as it does for any page. Vantage projects, files and chats are kept in your browser and are not sent to our servers.
We do not store any prompt or answer after the request, and nothing you type is used to train a model by us. The provider's own retention terms apply to the request while it is with them, and a provider you choose with your own key is under your own agreement with it. If that is not acceptable for your material, do not paste it into an AI box or connect that page to a chat.
A free-tier key from a model provider can let that provider keep your prompts to train its models and have people review them. Use a paid key for anything confidential.
Voice typing in Vantage uses your browser's own speech service. In Chrome that service is Google's, which receives the audio; we never do. Typing sends no audio anywhere.
The browser extension
The Suros Data Link fetches market data and company filings through your own browser, on your own connection. Without it the terminal serves those figures from the store our server keeps, and says so when a figure has not been fetched yet. The hosts it can reach are listed under Site access on the Data Link's Details page in your browser.
- The market data vendor and the filings archive see your IP address for these requests, as they would if you opened their sites yourself.
- Most requests carry no cookies. Requests that need a session with the market data vendor carry your browser's cookies for that vendor's site. If you are signed in to an account with that vendor, it can link those lookups to your account.
- Some of what it fetches is passed to our server, which reads it into the terminal's format and sends it back to you alone. It is not stored for other readers. That is market data, and nothing about you is added to it.
- It sends us no browsing history and cannot read the pages you visit. Its request counts stay in your browser.
Removing the Data Link puts every request back on our server's store.
Analytics
The first time you open one of these pages we ask whether we may count the visit. If you allow it, your browser tells our own server which page you opened, which site or campaign sent you, and whether the screen is phone-sized. The server adds that to daily totals and keeps nothing else: no IP address, no identifier and no cookie, so a count cannot be traced back to you. If you decline, nothing is sent. No third-party analytics runs on these pages.
Your current choice is shown here once the page has loaded.
Cookies and browser storage
Suros sets no advertising or tracking cookies of its own. This is everything it keeps in your browser:
| Name | Kind | What it is for | Kept for |
|---|---|---|---|
suros_session | Cookie, HttpOnly | Keeps you signed in. Page scripts cannot read it | 7 days, or until you sign out |
suros_oauth_state, suros_oauth_pkce | Cookies, HttpOnly | Protect a sign-in through an outside provider against forgery | 10 minutes |
suros_analytics_consent | Local storage | Remembers your answer to the counting question | Until you clear site data |
suros_theme and the terminal's own keys | Local storage | Your theme, and the working copy of your saved research described above | Until you clear site data, or sign out and clear this device |
suros.ai.key.* | Local storage | Your own AI provider key, only if you tick remember on this device. It is sent only to that provider | Until you remove it or clear site data |
None of these is used for advertising or tracking. Each holds something the site needs for what you asked it to do, so they are not behind the banner. Clearing your browser's data for surossystems.com removes all of them. Cookie settings at the foot of every page reopens the question.
Market data
Prices, fundamentals and other market figures are fetched from third-party providers. Those requests are made by our server, not by your browser, and we send only the ticker being looked at, never anything identifying you. There are two exceptions: crypto prices, which your browser reads straight from the exchange's public market data API, and the Data Link described above, if you install it. In both cases the provider sees your connection. The providers whose licence asks for a credit are named on the data sources page.
Who else sees your data
We do not sell personal data and we do not share it for advertising. Data is processed only by the services needed to run Suros, each acting on our instructions under a data-processing agreement:
- Vercel, hosting, CDN and serverless functions
- Hetzner, the data server behind the market and commodity pages. It sees your IP address and which account a request comes from
- Upstash, the managed database holding accounts, saved research, alerts, Community posts and API keys
- Resend, transactional email: verification, password reset, waitlist and alert mail
- Cloudflare, the metered gateway in front of the built-in AI model, and a host of that model
- Groq and OpenRouter, model providers for the AI features where they are configured. They see what the feature sends, as set out under The AI features, and nothing else
- Stripe, the payment processor for subscriptions. It takes the payment and holds the card details; we never see them
The list with what each one sees is also on the security page, and the agreements behind it are provided in full on request under our data processing addendum, which also carries the subprocessor change notice you are entitled to.
Transfers outside the EEA
Several of these companies are based in the US, so your data can be processed there. Each transfer rests on a safeguard the GDPR allows. Write to us for a copy.
| Recipient | Where | Safeguard |
|---|---|---|
| Vercel Inc. | US | EU-US Data Privacy Framework |
| Upstash Inc. | US | Standard contractual clauses |
| Cloudflare Inc. | US, and its servers worldwide | EU-US Data Privacy Framework and standard contractual clauses |
| Groq Inc. | US | Standard contractual clauses |
| OpenRouter Inc. | US | Standard contractual clauses |
| Resend Inc. | US | Standard contractual clauses |
| Stripe | Stripe Payments Europe in Ireland; Stripe Inc. in the US | EU-US Data Privacy Framework for the US part |
| Hetzner Online GmbH | Germany or Finland | Inside the EEA, none needed |
A model provider you choose with your own key is not on this list: your browser sends to it directly, under your own agreement with it.
Community
What you publish in Community is shown to other signed-in members with your username. A post you publish anonymously is shown without your name, but we still know which account posted it, so we can act on a report or a lawful request. Deleting a post removes it; deleting the account removes all of your posts.
People named in public filings
The terminal shows people who are named in filings that regulators publish: company insiders and their closely associated persons (US Form 4 and the Swedish insider register), holders of net short positions in European registers, filers of large shareholdings (13D and 13G), and individuals named in US advisers' Form ADV. A reader can set an alert on a named insider.
- Source: the public registers of the US Securities and Exchange Commission, Finansinspektionen and the European short-selling regulators.
- Why: to show who trades and holds what in listed companies, which is the reason those filings are public. The lawful basis is legitimate interest.
- What: the name, role, company and the trade or holding as filed. Nothing is added from any other source.
- Kept for: 90 days on the insider page, nine quarters for institutional holdings, the register's own history for short positions, and filings back to 2012 for the backtest's insider inputs.
- Your right to object: if you are named, write to data@surossystems.com. We stop showing you unless a compelling reason to keep a public filing visible outweighs your interests, and we tell you which.
We do not write to each person named, because there are tens of thousands of them and the filings are already public. This section is the notice.
Your rights
- Ask for a copy of everything we hold about you
- Correct anything inaccurate
- Have it deleted
- Withdraw consent at any time, including for analytics, notifications and the waitlist
- Receive your data in a portable format
- Object to processing based on legitimate interest
- Complain to the Norwegian Data Protection Authority, Datatilsynet
One email to data@surossystems.com is enough. We do not require a form. Export and deletion are also available from the account page without asking us.
Children
Suros is not directed at anyone under 18 and we do not knowingly collect their data.
Changes
If this policy changes materially we will say so on this page and, where the change affects data we already hold, by email. The date at the top always reflects the current version. The terms that govern the service itself are in the terms of service.