Security Overview

Last updated: July 14, 2026
Contact: hello@tryswell.co

​

Start here

​

Clear in 60 seconds

​

Product summary

Swell is a native macOS application that provides real-time coaching during sales discovery calls. During an active coaching session, the app:

1. Captures the user’s microphone and system audio (meeting audio from Zoom, Google Meet, etc.) with explicit user permission
2. Streams audio to Swell’s coaching relay over an authenticated WebSocket
3. Receives AI-generated coaching suggestions (flash prompts and instruction cards) during the call

The relay transcribes speech server-side and runs coaching models; the Mac app is a thin capture client and does not connect directly to speech-to-text or LLM providers. The Mac app does not call Convex directly — only Swell’s API and coaching relay do. Swell is designed for individual account executives evaluating the product on company-managed Macs. The Service is currently offered as an early access release. Operator: San Gregorio Labs Inc.

​

Architecture and data flow

Mac App (Swell)

• Mic and system audio (local; macOS permissions)
• wss://coach.tryswell.co — real-time coaching (authenticated WebSocket; streams split mic/system PCM upstream, receives coaching events downstream)
• https://api.tryswell.co — auth, profile, session APIs, app updates

Swell Backend

• Vercel (api.tryswell.co) — REST API, WorkOS auth proxy, transcript purge cron, Sparkle appcast
• Railway (coach.tryswell.co) — WebSocket coaching relay: audio ingress, speech-to-text, Ear (flash), Brain (suggestions), session finalize
• Convex — user profiles and session storage (accessed only by Swell servers, not the Mac)

AI subprocessors (server-side only; not invoked directly from the Mac)

• Deepgram — speech-to-text (invoked from coach-relay)
• OpenAI — real-time coaching trigger (“Ear”)
• Anthropic — coaching suggestion generation (“Brain”)

Key points for reviewers:

• Raw audio is not stored by Swell. Audio is streamed for real-time transcription and coaching only.
• Transcript text and coaching metadata are stored temporarily (default 24 hours), then automatically purged.
• Authentication tokens are stored in the macOS Keychain on the user’s device.
• The Mac does not hold Deepgram or LLM API keys; coaching infrastructure runs on Swell servers.

For firewall allowlists, see IT Network Requirements.

​

macOS permissions

Permissions are requested during onboarding. The app cannot capture audio without explicit user consent. Distribution note: App Sandbox is disabled, which is required for system audio capture. Swell is distributed as a notarized DMG outside the Mac App Store, signed with an Apple Developer ID certificate. Minimum OS: macOS 15.0

​

Authentication and access control

​

Encryption

TLS certificate pinning: Not used. Swell relies on the macOS system trust store so the app works on corporate-managed Macs with SSL/TLS inspection (Zscaler, Netskope, etc.).

​

Data retention

Transcript retention is configurable server-side (default 24 hours via TRANSCRIPT_RETENTION_HOURS).

​

Application distribution and updates

​

Subprocessors

Swell uses third-party services to operate the product. A full list with purposes and security links is in our Subprocessor list.

​

Certifications and compliance posture

San Gregorio Labs Inc. is an early-stage company and does not currently hold SOC 2 Type II or ISO 27001 certification. We select subprocessors with established security programs (e.g. Deepgram SOC 2, WorkOS security documentation). Enterprise customers requiring a DPA or security questionnaire should contact hello@tryswell.co.

​

Privacy and terms

• Privacy Policy
• Terms of Service

​

Reporting security issues

See Contact for vulnerability reporting and privacy request SLAs.

​

Document history