Security Overview

Last updated: October 26, 2026
Contact: hello@tryswell.co

Start here

Clear in 60 seconds

Model training and subprocessors

Your call content is not used to train Swell’s models or our AI vendors’ public models under standard API use. During a call, Swell runs these server-side AI steps on live audio or transcript:

1. Speech-to-text (Deepgram Nova-3): turns mic and meeting audio into transcript text
2. Coaching decision and tip writing (Anthropic Claude Opus 5.5 Fast via Vercel AI Gateway): after a completed exchange, reads the available call transcript, the latest exchange, and previously shown tips; returns silence or writes one flash tip in the same request

Product summary

Swell is a native macOS application that provides real-time coaching during sales discovery calls. During an active coaching session, the app:

1. Captures the user’s microphone and system audio (meeting audio from Zoom, Google Meet, etc.) with explicit user permission
2. Streams audio to Swell’s coaching relay over an authenticated WebSocket
3. Receives occasional short AI flash tips during the call (listening state otherwise)

The relay transcribes speech server-side and runs coaching models; the Mac app is a thin capture client and does not connect directly to speech-to-text or LLM providers. The Mac app does not call Convex directly; only Swell’s API and coaching relay do. Swell is designed for individual account executives evaluating the product on company-managed Macs. The Service is currently offered as an early access release. Operator: San Gregorio Labs Inc.

Architecture and data flow

The coaching relay is Swell’s real-time backend at coach.tryswell.co (hosted on Railway). It accepts authenticated WebSocket connections from the Mac, runs speech-to-text and AI coaching server-side, and returns coaching events. The Mac never connects to Deepgram, Vercel AI Gateway, or Anthropic directly. Mac App (Swell)

• Mic and system audio (local; macOS permissions)
• wss://coach.tryswell.co: real-time coaching (authenticated WebSocket; streams split mic/system PCM upstream, receives flash tips and session events downstream)
• https://api.tryswell.co: auth, profile, session APIs, app updates

Swell Backend

• Vercel (api.tryswell.co): REST API, WorkOS auth proxy, transcript purge cron, Sparkle appcast
• Railway (coach.tryswell.co): WebSocket coaching relay for audio ingress, speech-to-text, coaching decisions and tip writing, and session finalize
• Convex: user profiles and session storage (accessed only by Swell servers, not the Mac)

AI subprocessors (server-side only; not invoked directly from the Mac)

• Deepgram Nova-3: speech-to-text (audio sent from the coaching relay)
• Vercel AI Gateway: routes coaching requests containing transcript text, the latest exchange, and prior tips; receives a user identifier for request attribution
• Anthropic Claude Opus 5.5 Fast: decides whether to coach and writes the tip in one request (via AI Gateway; receives text, not call audio)

Key points for reviewers:

• Call content is not used to train Swell’s or our AI vendors’ models under standard API use; see Model training and subprocessors.
• Raw audio is not stored by Swell. Audio is streamed for real-time transcription and coaching only.
• Transcript text and flash tips are stored temporarily (default 24 hours), then automatically purged.
• Authentication tokens are stored in the macOS Keychain on the user’s device.
• The Mac does not hold Deepgram or LLM API keys; coaching infrastructure runs on Swell servers.

For firewall allowlists, see IT Network Requirements.

macOS permissions

Permissions are requested during onboarding. The app cannot capture audio without explicit user consent. Distribution note: App Sandbox is disabled, which is required for system audio capture. Swell is distributed as a notarized DMG outside the Mac App Store, signed with an Apple Developer ID certificate. Minimum OS: macOS 15.0

Authentication and access control

Internal access to your data

Swell is an early-stage company. Production systems (Convex database, Vercel API, Railway coaching relay at coach.tryswell.co) are accessible only to San Gregorio Labs engineering operators who hold dashboard credentials for those platforms; today, the founding engineering team. We do not yet operate a formal least-privilege access program or a separate production-support role. Customer call content in Convex is accessed only as needed for support, debugging, or legal compliance, not for model training. Application code enforces user-scoped database reads (WorkOS JWT) and server-only writes (per-service sync secrets); dashboard access is a separate, human-controlled layer.

Encryption

TLS certificate pinning: Not used. Swell relies on the macOS system trust store so the app works on corporate-managed Macs with SSL/TLS inspection (Zscaler, Netskope, etc.).

Data retention

Application distribution and updates

Subprocessors

Swell uses third-party services to operate the product. A full list with purposes and security links is in our Subprocessor list.

Certifications and compliance posture

San Gregorio Labs Inc. is an early-stage company and does not currently hold SOC 2 Type II or ISO 27001 certification. We select subprocessors with established security programs (e.g. Deepgram SOC 2, WorkOS security documentation). Our standard DPA is available to download directly. Enterprise customers requiring a completed security questionnaire or deal-specific redlines should contact hello@tryswell.co.

Privacy and terms

• Privacy Policy
• Terms of Service
• Data Processing Agreement (DPA)

Reporting security issues

See Contact for vulnerability reporting and privacy request SLAs.

Document history