Security you can check.
How we protect the organisations that use our products, where their data lives, and exactly which certifications apply, stated precisely.
01Certifications and alignment
Aligned with ISO 27001 and SOC 2.
Everything we run sits on Microsoft Azure, with Cloudflare for DNS and bot protection. Both hold ISO/IEC 27001 certification and SOC 2 Type 2 reports covering the services we use.
We design our own controls to line up with those frameworks: access control, encryption, logging, change management, supplier management and incident response.
Please note: the certificates and reports belong to Microsoft and Cloudflare. Swyft Software Ltd is not itself certified to ISO/IEC 27001 and has not been examined under SOC 2. Copies of the providers' reports are available from them directly, using the links here.
The international standard for information security management systems. Both providers are certified by accredited independent auditors and re-audited every year.
Independent examinations of security, availability and confidentiality controls, tested over a period of time by certified public accountants.
02How we protect data
Eight things we always do.
These apply to every Swyft product and to this website.
Front Door only
Our applications accept traffic only through Azure Front Door, with a web application firewall, rate limits and country rules in front. Direct requests are refused.
Controlled outbound traffic
Applications can only reach the outside services they need, through a firewall with an allow list. Everything else is blocked, including DNS.
Secrets in Key Vault
Each application has its own Azure Key Vault and managed identity. There are no passwords in code, configuration files or build pipelines.
Private databases
Databases have no public access at all. They are reached over private endpoints inside our own network.
Least privilege
Our products ask for the fewest permissions that do the job, read-only wherever possible, and each one is explained before you grant it.
Encrypted everywhere
TLS for everything in transit, with HSTS and modern ciphers, and encryption at rest for every database and storage account.
Separate customers
Every request in our multi-customer products is scoped to one organisation, so no customer can ever reach another’s data.
Repeatable releases
Infrastructure is written as code and every release goes through the same automated pipeline, signed in with short-lived credentials.
03Where data lives
In the EU, by default.
- Applications
- Microsoft Azure, West Europe (the Netherlands)
- Databases
- Azure SQL Database, Germany West Central (Frankfurt), private network only
- Secrets
- Azure Key Vault, one per application
- Edge
- Azure Front Door with a web application firewall
- Resend, sending from the EU (Ireland)
- DNS and bot checks
- Cloudflare
Where a provider may access data from outside the European Economic Area, we rely on the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses. Our privacy policy has the details.
04Reporting a vulnerability
Found something? Tell us.
If you believe you have found a security issue in any Swyft product or website, please report it to us privately through our contact form, choosing "Reporting a security issue".
We will acknowledge your report within two working days, keep you updated while we fix it, and credit you if you would like. Please give us a reasonable time to fix the issue before telling anyone else, and do not access or change other people's data while testing.
Our security contact details are also published at swyftsoft.com/.well-known/security.txt.