> ## Documentation Index > Fetch the complete documentation index at: https://security.tryswell.co/llms.txt > Use this file to discover all available pages before exploring further. # IT Network Requirements > Firewall allowlists, TLS/SSL inspection, macOS permissions, and MDM notes for corporate IT evaluating Swell. **Last updated:** July 14, 2026\ **Contact:** [hello@tryswell.co](mailto:hello@tryswell.co) One-page reference for corporate IT teams evaluating Swell on managed Macs. For full context, see the [Security Overview](/). ## Summary Swell is a native macOS app for real-time sales call coaching. It requires outbound HTTPS and WSS from the user's Mac to Swell domains only. Speech-to-text and coaching AI run on Swell's servers (coach-relay on Railway); the Mac does not connect directly to Deepgram, OpenAI, or Anthropic. Raw audio is not stored by Swell. Transcript text is retained for 24 hours by default, then automatically purged. ## Domains to allowlist Allow outbound traffic from user Macs: | Domain | Port | Protocol | Purpose | Required | | ----------------- | ---- | -------- | ----------------------------------------------- | ------------- | | api.tryswell.co | 443 | HTTPS | Authentication, REST API, Sparkle app updates | Yes | | coach.tryswell.co | 443 | WSS | Real-time coaching (`wss://coach.tryswell.co/`) | Yes | | `*.workos.com` | 443 | HTTPS | Google OAuth sign-in (default system browser) | Yes (sign-in) | **Sign-in flow:** Authentication opens the user's default web browser (not an embedded WebView). WorkOS hostnames must be reachable during login. The Mac app requests Google OAuth via WorkOS AuthKit. **Not required on the Mac:** `api.deepgram.com` and other AI vendor endpoints. Deepgram speech-to-text is invoked server-side from Swell's coaching relay. **Optional or intermittent:** | Domain | Purpose | | ----------------------------------------- | -------------------------------------------------------- | | GitHub Releases (if used for DMG hosting) | Initial app download only; confirm your distribution URL | | `*.sentry.io` | Crash and error reporting (if enabled in build) | ## TLS and SSL inspection * All connections use TLS 1.2 or later. * Swell uses the macOS system trust store (no certificate pinning). * Corporate SSL/TLS inspection is supported (Zscaler, Netskope, etc.) provided the inspection CA is trusted by the Mac. * `api.tryswell.co` serves HSTS and related security headers on all routes. ## macOS permissions (user-granted) | Permission | System Settings path | Purpose | | ---------------------- | -------------------------------------------- | ---------------------------------------- | | Microphone | Privacy and Security, Microphone | AE speech | | System Audio Recording | Privacy and Security, System Audio Recording | Meeting and prospect audio (macOS 14.2+) | IT cannot pre-approve all permission types via MDM; users grant access during onboarding. Swell cannot capture audio without consent. ## Application installation | Item | Detail | | ------------- | -------------------------------------------------- | | Distribution | Direct download (notarized DMG); not Mac App Store | | Code signing | Apple Developer ID | | App Sandbox | Disabled (required for system audio capture) | | Minimum macOS | 15.0 | **MDM tip:** Deploy via approved software catalog or allowlist the Developer ID team ID after reviewing the signed bundle. Gatekeeper requires notarization for smooth install. ## Data residency and egress | Traffic | Origin | Destination | Content | | -------------------------- | --------------------------- | ----------------- | --------------------------------------------------------------------------------------------------- | | Coaching (audio + session) | Mac | coach.tryswell.co | Split mic/system PCM audio streams, session metadata, coaching events (audio not retained by Swell) | | API | Mac | api.tryswell.co | Auth, profile, session start, app updates | | STT | Swell servers (coach-relay) | Deepgram | Audio stream (transit; not retained by Swell) | | LLM processing | Swell servers (coach-relay) | OpenAI, Anthropic | Transcript text (server-side only) | | Session storage | Swell servers | Convex | Transcript and coaching data (temporary; Mac does not call Convex directly) | Swell subprocessors may process data in the United States. See our [Subprocessor list](/subprocessors). ## Security contacts | Topic | Email | | ----------------------------------- | --------------------------------------------- | | Security review and vulnerabilities | [hello@tryswell.co](mailto:hello@tryswell.co) | | Privacy and data deletion | [hello@tryswell.co](mailto:hello@tryswell.co) | | End-user support | [hello@tryswell.co](mailto:hello@tryswell.co) | ## FAQ for IT reviewers **Does Swell record and store calls?** Swell streams audio for real-time transcription and coaching. We do not retain raw audio. Transcript text is stored temporarily (default 24 hours) for coaching and session history, then purged. **Does the Mac need egress to Deepgram or OpenAI?** No. The Mac connects only to Swell domains (`api.tryswell.co`, `coach.tryswell.co`) plus WorkOS during sign-in. Speech-to-text and LLM processing happen on Swell servers. **How does sign-in work?** Users sign in with Google via WorkOS AuthKit. The Mac opens the default system browser for OAuth; it does not embed a WebView for authentication. **Is SOC 2 available?** Swell (San Gregorio Labs Inc.) does not yet hold SOC 2. Deepgram and other subprocessors maintain their own certifications. See our [Subprocessor list](/subprocessors). **Does the app work with VPN and SSL inspection?** Yes, when the Mac trusts the inspection CA. ## Related documents * [Security Overview](/) * [Privacy Policy](/privacy) * [Subprocessor list](/subprocessors)