Contact: hello@tryswell.co One-page reference for corporate IT teams evaluating Swell on managed Macs. For full context, see the Security Overview.
Summary
Swell is a native macOS app for real-time sales call coaching. It requires outbound HTTPS and WSS from the user’s Mac to Swell domains only. Speech-to-text and coaching AI run on Swell’s servers (coach-relay on Railway); the Mac does not connect directly to Deepgram, OpenAI, or Anthropic. Raw audio is not stored by Swell. Transcript text is retained for 24 hours by default, then automatically purged.Domains to allowlist
Allow outbound traffic from user Macs:
Sign-in flow: Authentication opens the user’s default web browser (not an embedded WebView). WorkOS hostnames must be reachable during login. The Mac app requests Google OAuth via WorkOS AuthKit.
Not required on the Mac:
api.deepgram.com and other AI vendor endpoints. Deepgram speech-to-text is invoked server-side from Swell’s coaching relay.
Optional or intermittent:
TLS and SSL inspection
- All connections use TLS 1.2 or later.
- Swell uses the macOS system trust store (no certificate pinning).
- Corporate SSL/TLS inspection is supported (Zscaler, Netskope, etc.) provided the inspection CA is trusted by the Mac.
api.tryswell.coserves HSTS and related security headers on all routes.
macOS permissions (user-granted)
IT cannot pre-approve all permission types via MDM; users grant access during onboarding. Swell cannot capture audio without consent.
Application installation
MDM tip: Deploy via approved software catalog or allowlist the Developer ID team ID after reviewing the signed bundle. Gatekeeper requires notarization for smooth install.
Data residency and egress
Swell subprocessors may process data in the United States. See our Subprocessor list.
Security contacts
FAQ for IT reviewers
Does Swell record and store calls? Swell streams audio for real-time transcription and coaching. We do not retain raw audio. Transcript text is stored temporarily (default 24 hours) for coaching and session history, then purged. Does the Mac need egress to Deepgram or OpenAI? No. The Mac connects only to Swell domains (api.tryswell.co, coach.tryswell.co) plus WorkOS during sign-in. Speech-to-text and LLM processing happen on Swell servers.
How does sign-in work?
Users sign in with Google via WorkOS AuthKit. The Mac opens the default system browser for OAuth; it does not embed a WebView for authentication.
Is SOC 2 available?
Swell (San Gregorio Labs Inc.) does not yet hold SOC 2. Deepgram and other subprocessors maintain their own certifications. See our Subprocessor list.
Does the app work with VPN and SSL inspection?
Yes, when the Mac trusts the inspection CA.