Security

SwiftCode is built for clinical communication environments. Here's how we protect your data, and where we are on our path to production healthcare readiness.

Platform security

Designed for healthcare from day one.

Security by design

Security is built into SwiftCode from the ground up — least-privilege access, isolated facility data, and defense-in-depth across the stack.

Encryption in transit and at rest

Data is protected in transit with TLS. At-rest encryption is provided by our managed database layer as part of our security architecture.

Role-based access control

Access is scoped by role (admin, supervisor, charge nurse, RN, CNA, tech) so staff only see what their role requires.

Minimal data footprint

We collect only what is required to operate — alert metadata, dispatch status, messages, and timestamps. No advertising or external tracking analytics.

Encryption

Data is protected in transit with TLS; at-rest encryption is provided by our managed database layer.

Data is protected in transit with TLS (HTTPS/WSS); certificate-managed TLS termination is being rolled out across all public endpoints.

At-rest encryption is provided by our managed database layer as part of our security architecture.

Realtime delivery uses secure WebSocket connections; the message broker uses TLS with per-facility topic authorization, and push notifications are delivered over Apple's encrypted APNs channel.

Authentication tokens (JWT) are short-lived with automatic expiration, refresh, and server-side revocation; they are sent in request headers and stored in the device Keychain.

Authentication & access control

Access is scoped by role, and sessions are kept short-lived.

Role-based access control with database-backed permissions and system roles.

Sign-in via SwiftCode ID (ZITADEL Cloud): single sign-on, multi-factor authentication, and passkeys over OpenID Connect / OAuth 2.0 — credentials are held by ZITADEL, not SwiftCode. Legacy password sign-in is being retired.

Identity is delegated to ZITADEL; SwiftCode resolves each user's roles and facility access itself, so revoking a user or changing a role takes effect immediately.

Automatic token expiration, proactive refresh, and server-side revocation on logout, deactivation, or role change.

Per-facility data isolation enforced by access controls at the API layer, sourced from the verified session — never client input.

Per-account login lockout and rate limiting to resist brute-force attempts.

Biometric App Lock (Face ID / Touch ID) with an idle timeout on the mobile apps for shared clinical devices.

Infrastructure

Hosted on Amazon Web Services in the United States.

AWS (us-west-2)

Application services run on AWS ECS Fargate. Databases and cache run on managed AWS services in the United States.

Managed data layer

PostgreSQL and Redis run as managed services, benefiting from AWS-provided patching, backups, and at-rest encryption.

Realtime + push

Load-balanced realtime WebSocket delivery with Redis pub/sub, plus Apple Push Notification service for time-critical alerts.

Network isolation

Internal services (database, cache, message broker) are restricted to the private network and reachable only from application services.

Managed secrets

Application secrets are stored in AWS Secrets Manager and encrypted with a dedicated KMS key — not embedded in code or container images.

HIPAA readiness

SwiftCode is being developed with HIPAA Security Rule requirements in mind and is actively progressing toward production healthcare readiness.

Architecture designed with HIPAA Security Rule requirements in mind

Data protected in transit with TLS; managed-database encryption at rest

Audit logging of key security, authentication, and clinical events

Role-based access control, per-facility isolation, and server-side session revocation

Minimal-PHI approach: sensitive detail is kept out of notifications and event payloads where possible

Business Associate Agreement (BAA) discussions available for enterprise partners

SwiftCode has not completed a third-party HIPAA audit or certification. We are happy to share our current security posture and roadmap with prospective healthcare partners under NDA.

Audit logging

Audit logging of key security and clinical events.

Audit logging of key security and clinical events (incidents, code activation, dispatch, resolution).

Authentication events — sign-in, sign-in failure, and sign-out — are logged with source IP and device context.

Administrative changes (users, roles, permissions) are recorded through audit middleware.

Durable, append-only event log for critical incident state changes, with metadata to support post-incident review.

Exportable, complete audit-trail tooling is on our roadmap and not yet a finished feature.

Responsible disclosure

We welcome reports from security researchers.

If you believe you have found a security vulnerability in SwiftCode, please report it to us privately so we can investigate and remediate before any public disclosure.

Email security@swiftcode.tech with details and reproduction steps.
Give us a reasonable window to investigate and resolve before disclosing publicly.
Do not access, modify, or delete data that is not your own, and avoid privacy violations or service disruption.
We will acknowledge your report and keep you informed of remediation progress.

Security contact

For security questions, vulnerability reports, or to request our security posture and roadmap under NDA, reach our security team directly.

Email security@swiftcode.tech

Subprocessors

The third-party services we rely on for core functionality.

ZITADEL Cloud

Identity and authentication for SwiftCode ID — single sign-on, MFA, passkeys, and OpenID Connect. Holds staff sign-in credentials so SwiftCode does not.

Amazon Web Services (AWS)

Cloud hosting, managed database, cache, and SMS delivery infrastructure.

Apple Push Notification service (APNs)

Delivery of time-critical push notifications to iOS and watchOS devices.

SMS provider (via AWS)

Fallback SMS notifications when push cannot be delivered. Integration is being finalized.

Netlify

Static hosting for the marketing and web-fallback surfaces.

Data protection

Minimal collection, isolated storage, and no advertising use.

We collect only the data required to operate the platform.

Each facility's data is isolated from other facilities by access controls.

We do not sell or share personal data for marketing, and we do not run external tracking analytics.

Data deletion can be requested by a facility administrator at any time.

Availability

Built for reliable delivery of time-critical alerts.

Load-balanced services on AWS ECS Fargate with managed, backed-up databases.

PostgreSQL and durable events are the source of truth; realtime channels are recoverable via resync.

Clients reconnect and resync missed events automatically after network interruptions.

A public status page is on our roadmap (coming soon).

Incident response

How we handle a suspected security incident.

Suspected incidents are triaged and investigated by our engineering team.

We contain and remediate identified issues as a priority, with concrete levers such as session revocation and secret rotation.

We notify affected facility administrators where appropriate and required.

A documented incident-response plan (including breach-notification steps) has been drafted and is being formalized and tabletop-tested.

Security best practices

How your facility can help keep accounts secure.

Assign each staff member their own account and role — avoid shared logins.

Deactivate accounts promptly when staff leave your facility.

Keep the SwiftCode apps updated to the latest available build.

Report anything suspicious to your administrator or to security@swiftcode.tech.

Frequently asked questions

Is SwiftCode HIPAA compliant?

SwiftCode is being developed with HIPAA Security Rule requirements in mind and is actively progressing toward production healthcare readiness. SwiftCode has not completed a third-party HIPAA audit or certification. We are happy to share our current security posture and roadmap with prospective healthcare partners under NDA.

Is data encrypted?

Yes. Data is protected in transit with TLS, and at-rest encryption is provided by our managed database layer. Session tokens are short-lived, sent in request headers, and stored in the device Keychain. We do not describe SwiftCode as end-to-end encrypted.

How do staff sign in? Do you support SSO, MFA, and passkeys?

Staff sign in with SwiftCode ID — single sign-on built on ZITADEL Cloud using OpenID Connect / OAuth 2.0, with multi-factor authentication and passkeys. Authentication is delegated to ZITADEL, a dedicated identity provider; SwiftCode resolves each user's roles and facility access itself.

Does SwiftCode store our passwords?

SwiftCode ID credentials — passwords, MFA, and passkeys — are held and verified by ZITADEL Cloud, not by SwiftCode; we receive a standards-based identity token. We are retiring the legacy password sign-in path as staff move to SwiftCode ID. ZITADEL maintains its own SOC 2 Type II and ISO 27001 certifications for the identity service; see our Trust Center for details.

Do you store Protected Health Information (PHI)?

SwiftCode is designed to minimize PHI. We keep sensitive clinical detail out of notifications and event payloads where possible and collect only the data required to operate.

Can we get a BAA?

We are happy to discuss Business Associate Agreements with enterprise healthcare partners as part of onboarding.

How do I report a security issue?

Email security@swiftcode.tech. See our responsible disclosure guidance below.

Questions about our security posture?

We work with healthcare organizations to meet their requirements and share our roadmap under NDA.