Your data, encrypted, backed up, and restorable.
The unglamorous work, done properly: encrypted everywhere, recoverable always, observable in real time - and honest about what we haven’t finished yet.
Encrypted on the wire, on disk, and in backups
There is no plaintext path to your data - not over the network, not at rest, not in the backup bucket.
SSL is required by default on databases and storage - certificates are managed and auto-renewed. Standard rejectUnauthorized: true works out of the box.
Databases, bucket objects, and backups are encrypted at rest. Connection strings and secrets are encrypted in our control plane and masked in the UI until you reveal them.
Backups are encrypted with keys separate from the live data, so a backup artifact is useless on its own.
Daily, encrypted, and actually restored
A backup you have never restored is a hope, not a backup. We restore ours on a schedule so you don't discover the gap during an outage.
Automated every day, checksummed, encrypted. Retention is 7 days on Starter and 30 days on Growth; custom on Enterprise.
Restore any backup in a click - into a brand-new database or in place of the existing one. No support ticket, no manual SQL.
We restore from backups automatically every week and verify the result, so recovery is a routine, not an experiment.
Least privilege by default
No shared admin key. Every credential is scoped to exactly what it should reach, and every change is recorded.
Per-database roles and per-bucket access keys. Rotate them from the dashboard whenever you need - nothing depends on a single god-mode secret.
Restrict database connections to specific IPs or CIDR ranges. Default is open with strong auth; lock it down as tightly as you like.
Every state change in the dashboard - actor, IP, target, before/after - is recorded. Exportable on Growth and above.
Project-level roles and ownership, so contractors and teammates get exactly the access they need - and nothing more.
Protect your account with TOTP-based 2FA. Recommended for every owner and admin on an organization.
Single sign-on through your identity provider on Enterprise, so access follows your existing joiner/leaver process.
Stored safely, and recoverable
Your data is stored encrypted, backed up, and restorable, with disaster recovery in place and extremely fast support when you need a human.
Every database, object, and backup is encrypted, and any backup restores in one click. Your data isn't just stored, it's recoverable.
Daily encrypted backups in your chosen region, with weekly restore drills, so recovery is a routine we've already rehearsed, not a scramble.
When something needs a human, you get a quick, personal reply from people who know the platform, not a multi-day ticket queue.
You choose where your data lives
Pick a region at signup and your data stays there. We process it to run the service - we never sell it.
Databases, buckets, and their backups live in the region you select. More regions are rolling out.
Data residency, export, and deletion controls built in. A Data Processing Addendum is available on Enterprise or on request.
pg_dump and bucket object export are first-class. There's no lock-in tax on leaving - you can take everything with you.
What we have, and what we’re still building
We’d rather tell you the truth than wave a badge we haven’t earned. Today we run on least-privilege access, encryption in transit and at rest, audit logging, and tested recovery. We do not yet hold a SOC 2 report or ISO certification - a formal SOC 2 audit is on the roadmap, and we’ll say so here the day it lands. If you need a security questionnaire completed, a DPA signed, or a review call before you trust us with production data, we’ll make time for it.
Security FAQ
Is data encrypted in transit and at rest?
Yes. Every database and storage connection uses TLS (SSL is required by default, not optional). Data at rest - databases, bucket objects, and backups - is encrypted with AES-256. Backups are encrypted with separate keys from the live data.
Where is my data stored?
In the region you choose at signup: US or EU. Your databases, buckets, and their backups stay in that region. Operational metadata (account, billing, usage) lives in our control-plane database. See the Privacy Policy for the full data-flow breakdown.
Are backups actually tested?
Yes. We run automated restore drills weekly, because a backup you've never restored isn't a backup. Daily encrypted backups are retained 7 days on Starter and 30 days on Growth; custom retention and point-in-time recovery are available on Enterprise.
Can I restrict who and what connects?
Yes. Use per-database roles, per-bucket access keys, and connection IP allowlisting (specific IPs or CIDR ranges). Credentials are scoped - there's no shared admin key - and can be rotated from the dashboard. SSO via SAML is available on Enterprise.
Do you have a SOC 2 report or ISO certification?
Not yet, and we won't pretend otherwise. We build to those controls - least-privilege access, encryption everywhere, audit logging, tested recovery - and a formal SOC 2 audit is on the roadmap. If you need a security review or DPA today, email security@swyftstack.com and we'll work with you.
How do I report a security vulnerability?
Email security@swyftstack.com with details and reproduction steps. We acknowledge reports within one business day, keep you updated, and credit researchers who report responsibly. Please don't run intrusive tests against production or other customers' data.
What happens during an incident?
We detect incidents automatically and post to the status page as we investigate. For incidents that affect customer data or availability, we publish a public postmortem within 7 days with the root cause and the fix.
Ship on infrastructure you can vouch for.
Encrypted everywhere, restorable always, observable in real time. Deploy in seconds, cancel in one click.