Security

Security at Swfte

Last reviewed: 2026-09-23

This page lists the controls we can stand behind today. For what is still in progress and what we do not claim, see the trust centre.

Data location and encryption

Customer data is stored in AWS eu-west-1 (Ireland).
Data at rest is encrypted: RDS databases are encrypted, most DynamoDB tables use a KMS key, and S3 uses SSE-S3. Keys are managed by AWS and Swfte; customer-managed keys are not offered.
Traffic to our API uses TLS 1.2 or later (TLS 1.3 preferred).

On the device

On-device mode: prompts are processed by a local model on your Mac and are not sent to Swfte or to model providers.
Screen capture, microphone listening and wake word are all off by default.
Product telemetry is off by default.
Computer-use actions are recorded in a local audit log.
Local models downloaded from Hugging Face are pinned to a fixed revision and checksum-verified.

Identity and access

Sign-in via Google, Microsoft or GitHub through WorkOS.
Enterprise SAML SSO, SCIM provisioning and MFA enforcement are in development and not available today.

Models and providers

Cloud intelligence levels send prompts to model providers through our gateway. The model cards list which provider serves each level.
Zero-data-retention agreements with model providers are in progress and not yet in place.

Model cards · Sub-processors (draft) · DPA (draft template)

Responsible disclosure

If you believe you have found a security vulnerability in Cortex, swfte.com or our API, email security@swfte.com. Please include:

the affected product, URL or app version;
steps to reproduce, and a proof of concept if you have one;
the impact you believe it has;
how we can reach you for follow-up.

We aim to acknowledge reports within <business days — founder to fill> and will keep you informed while we fix the issue. Please give us reasonable time to fix it before disclosing it publicly.

If you act in good faith — you avoid privacy violations, data destruction and service disruption, only access the data you need to demonstrate the issue, and do not use social engineering or physical attacks — we will not pursue or support legal action against you for your research. We do not run a paid bug bounty today.

Security questions

No. A SOC 2 Type I audit is in preparation; the target date is on our trust page. We do not hold ISO 27001, and we do not sign HIPAA Business Associate Agreements today.

Not yet. We do not offer a contractual uptime SLA today.

Yes. Email security@swfte.com. We will answer a security questionnaire and share our architecture overview. The DPA is a draft template pending legal review.