Surface Security: Designed for Trust