Security Overview

Last updated: August 20, 2026
Contact: hello@tryswell.co

​

Start here

​

Clear in 60 seconds

​

Model training and subprocessors

Your call content is not used to train Swell’s models or our AI vendors’ public models under standard API use. During a call, Swell runs these server-side AI steps on live audio or transcript:

1. Speech-to-text (Deepgram): turns mic and meeting audio into transcript text
2. Moment detection (OpenAI Realtime): listens for discovery moments that may deserve a tip; does not invent the tip text shown to the AE
3. Flash tip decision (Google Gemini via Vercel AI Gateway): decides silence vs flash; does not write the tip text shown to the AE
4. Flash tip authoring (Anthropic Claude Haiku via Vercel AI Gateway): writes the short flash tip only when decide said flash
5. Ledger tick (Google Gemini via Vercel AI Gateway): periodic backend updates to live coaching state from the transcript

​

Product summary

Swell is a native macOS application that provides real-time coaching during sales discovery calls. During an active coaching session, the app:

1. Captures the user’s microphone and system audio (meeting audio from Zoom, Google Meet, etc.) with explicit user permission
2. Streams audio to Swell’s coaching relay over an authenticated WebSocket
3. Receives occasional short AI flash tips during the call (listening state otherwise)

The relay transcribes speech server-side and runs coaching models; the Mac app is a thin capture client and does not connect directly to speech-to-text or LLM providers. The Mac app does not call Convex directly; only Swell’s API and coaching relay do. Swell is designed for individual account executives evaluating the product on company-managed Macs. The Service is currently offered as an early access release. Operator: San Gregorio Labs Inc.

​

Architecture and data flow

The coaching relay is Swell’s real-time backend at coach.tryswell.co (hosted on Railway). It accepts authenticated WebSocket connections from the Mac, runs speech-to-text and AI coaching server-side, and returns coaching events. The Mac never connects to Deepgram, OpenAI, Anthropic, or Google directly. Mac App (Swell)

• Mic and system audio (local; macOS permissions)
• wss://coach.tryswell.co: real-time coaching (authenticated WebSocket; streams split mic/system PCM upstream, receives flash tips and session events downstream)
• https://api.tryswell.co: auth, profile, session APIs, app updates

Swell Backend

• Vercel (api.tryswell.co): REST API, WorkOS auth proxy, transcript purge cron, Sparkle appcast
• Railway (coach.tryswell.co): WebSocket coaching relay for audio ingress, speech-to-text, moment detection, flash tip decide/author, ledger ticks, and session finalize
• Convex: user profiles and session storage (accessed only by Swell servers, not the Mac)

AI subprocessors (server-side only; not invoked directly from the Mac)

• Deepgram: speech-to-text (invoked from the coaching relay)
• OpenAI: moment detection (Realtime API; direct from the coaching relay)
• Vercel AI Gateway: routes flash-tip decide/author and ledger-tick requests (coaching relay → Gateway → Anthropic or Google)
• Anthropic: flash tip authoring (via AI Gateway)
• Google (Gemini): flash tip decision and ledger tick (via AI Gateway)

Key points for reviewers:

• Call content is not used to train Swell’s or our AI vendors’ models under standard API use; see Model training and subprocessors.
• Raw audio is not stored by Swell. Audio is streamed for real-time transcription and coaching only.
• Transcript text, flash tips, and backend coverage checkpoints are stored temporarily (default 24 hours), then automatically purged.
• Authentication tokens are stored in the macOS Keychain on the user’s device.
• The Mac does not hold Deepgram or LLM API keys; coaching infrastructure runs on Swell servers.

For firewall allowlists, see IT Network Requirements.

​

macOS permissions

Permissions are requested during onboarding. The app cannot capture audio without explicit user consent. Distribution note: App Sandbox is disabled, which is required for system audio capture. Swell is distributed as a notarized DMG outside the Mac App Store, signed with an Apple Developer ID certificate. Minimum OS: macOS 15.0

​

Authentication and access control

​

Internal access to your data

Swell is an early-stage company. Production systems (Convex database, Vercel API, Railway coaching relay at coach.tryswell.co) are accessible only to San Gregorio Labs engineering operators who hold dashboard credentials for those platforms; today, the founding engineering team. We do not yet operate a formal least-privilege access program or a separate production-support role. Customer call content in Convex is accessed only as needed for support, debugging, or legal compliance, not for model training. Application code enforces user-scoped database reads (WorkOS JWT) and server-only writes (per-service sync secrets); dashboard access is a separate, human-controlled layer.

​

Encryption

TLS certificate pinning: Not used. Swell relies on the macOS system trust store so the app works on corporate-managed Macs with SSL/TLS inspection (Zscaler, Netskope, etc.).

​

Data retention

​

Application distribution and updates

​

Subprocessors

Swell uses third-party services to operate the product. A full list with purposes and security links is in our Subprocessor list.

​

Certifications and compliance posture

San Gregorio Labs Inc. is an early-stage company and does not currently hold SOC 2 Type II or ISO 27001 certification. We select subprocessors with established security programs (e.g. Deepgram SOC 2, WorkOS security documentation). Our standard DPA is available to download directly. Enterprise customers requiring a completed security questionnaire or deal-specific redlines should contact hello@tryswell.co.

​

Privacy and terms

• Privacy Policy
• Terms of Service
• Data Processing Agreement (DPA)

​

Reporting security issues

See Contact for vulnerability reporting and privacy request SLAs.

​

Document history