Security at Swarmia

We collect data from the tools you connect and information you submit directly. Depending on the integrations and features you use, this can include code changes and reviews, timestamps, automated build and test results, tasks, comments, contributor details, AI-tool usage metrics, and survey responses.

Names and email addresses help us connect activity to the right people and teams. The underlying data isn’t anonymous. Our data-access documentation explains what each integration collects.

We collect only the data needed for the integrations and features you use. You can choose which GitHub repositories the app can access. Other options for limiting access depend on the integration. See our data-access documentation for details.

Our standard source-control integrations don’t store your source code. For commit analysis, we use change statistics, such as file names and the number of lines added or removed, rather than reading the code itself. We still collect other information about engineering work.

GitHub’s repository contents permission lets us retrieve commit information, but also grants access to source-code contents. With a custom GitHub App or a GitHub Enterprise installation, you can omit this permission. Some commit-based data and metrics will then be limited or unavailable. You can also choose which repositories the app can access.

We encrypt your data in transit and at rest. Requests use TLS 1.2 or later, and stored data uses AES-256 encryption. We restrict access to authorized personnel and log access.

Our main production environment runs on Google Cloud in Frankfurt, Germany. We keep encrypted backups in the same region, with additional encrypted backups on AWS in Europe.

EU hosting doesn’t mean all processing stays in the EU. Some of our service providers process data outside the European Economic Area, including AI processing in the US. Our subprocessor list explains who processes data, why, and where. Our DPA explains the safeguards for international transfers.

Email hello@swarmia.com to discuss your US hosting requirements and the available options. EU hosting is the default. Any alternative arrangement needs to be agreed with us.

We use service providers, called subprocessors, to help us host and process your data. These include cloud infrastructure and AI providers. Our subprocessor list explains each provider’s role and processing location. Our DPA sets requirements for how they handle personal data.

We use OpenAI and Anthropic for AI-assisted analysis, summaries, and classifications. They may process your questions, relevant engineering data, or survey feedback. Both providers process data in the US. Our AI Addendum explains the terms that apply.

No. We don’t use your customer material, including AI inputs and outputs, to train models. We don’t allow our subcontractors or AI providers to do so either.

We may use de-identified or aggregated data about how the service operates to improve it. This excludes your customer material, AI inputs, and AI outputs.

AI is enabled by default for all customers. To opt out of functionality provided by the AI providers marked with an asterisk on our subprocessor list, email hello@swarmia.com. The related AI functionality may then be unavailable.

By default, we sync one year of historical data when you connect your tools. We then keep that history and add new data as work happens throughout your contract. This isn’t a rolling one-year retention window: older data doesn’t automatically expire after a year.

The initial sync window is different from how long we retain data. When your contract ends, data return and deletion follow your agreement and our DPA. Backup copies follow a separate deletion schedule.

Contact customer support to request permanent deletion. You can also email hello@swarmia.com for help with the request.

Our DPA covers returning or deleting personal data when your agreement ends or when you request it in writing. Legal retention requirements may apply. Deleting live data and removing backup copies are separate steps: under our standard terms, encrypted backup copies may remain for up to 90 days.

We don’t sell personal data we process on your behalf. Our DPA limits its use to providing the service and sets requirements for our subprocessors. Our privacy policy separately explains how we handle account details, business-contact information, and website data.

You can sign in through Okta, Microsoft Entra ID, Google Workspace, or GitHub. Our enterprise SSO connections use OpenID Connect (OIDC), rather than native SAML. Your identity provider can enforce multi-factor authentication.

Enabling Okta SSO disables GitHub login for your organization. With Google authentication enabled, users who start with GitHub login are redirected to Google. Roles and permissions control who can manage your organization and its settings.

Sensitive credentials, such as access tokens, receive an additional layer of encryption before storage, beyond the cloud platform’s default encryption at rest.

Admins can create and revoke API tokens in Swarmia. Tokens have scopes that limit which API capabilities they can use. Give each integration only the access it needs, and keep tokens private.

MCP clients connect through user authorization or an API token. MCP access follows Swarmia’s organization and role permissions. Repository activity from connected repositories, including private ones, can be visible to Swarmia members even if they can’t access those repositories in GitHub. Sensitive areas, such as cost data and survey responses, have additional role restrictions.

When you export data or connect an external tool, the requested data goes to the destination you choose. That tool’s terms, security controls, and retention settings apply to its copy. Choose approved destinations and review what you share.

An AI assistant you connect through MCP is a separate data flow from the AI providers Swarmia uses to deliver its own AI functionality.

We’re open to adopting additional certifications. If there’s a certification you need that we don’t currently have, tell us what you’re looking for. We’d like to hear what we may be missing and understand whether it would help your organization.

Email hello@swarmia.com or contact your account team. We can share our SOC 2 Type 2 and ISAE 3402 Type 2 (SOC 1 Type 2) reports and help with penetration-test documentation and security questionnaires. Some detailed materials may require a confidentiality agreement.

If we become aware of a personal data breach, we’ll notify you without undue delay, as required by our DPA. We’ll include the information required by data-protection law. If we don’t have all the details at once, we’ll provide updates as we learn more.

Email hello@swarmia.com with a description, steps to reproduce it, and the potential impact. Our Vulnerability Disclosure Policy explains what’s in scope, how to report an issue, and when rewards apply.