Skip to main content
Last updated: July 24, 2026
Contact: hello@tryswell.co Swell (San Gregorio Labs Inc.) uses the following third-party service providers (“subprocessors”) to operate the Service. This list applies to personal data and call content processed on our behalf. We review subprocessors for security and privacy practices appropriate to their role. Enterprise customers requiring notification of subprocessor changes or a DPA should contact hello@tryswell.co.

​
Infrastructure and platform

​
Vercel

  • Purpose: REST API hosting, auth proxy, transcript purge cron, Sparkle appcast
  • Data processed: Account tokens (transit), API metadata, session sync
  • Location: United States
  • Security documentation: vercel.com/security

​
Railway

  • Purpose: WebSocket coaching relay (coach-relay)
  • Data processed: Audio streams (transit), transcript text, session metadata, coaching state
  • Location: United States
  • Security documentation: railway.app/legal/privacy

​
Convex

  • Purpose: Database (profiles, session storage)
  • Data processed: Email, user ID, transcripts, coaching data (temporary)
  • Location: United States
  • Security documentation: convex.dev/security

​
Upstash

  • Purpose: Distributed rate limiting (auth and LLM-cost paths)
  • Data processed: User IDs, rate-limit counters (metadata)
  • Location: United States or EU (region-dependent)
  • Security documentation: upstash.com/trust

​
Authentication

​
WorkOS

  • Purpose: User authentication (Google OAuth via AuthKit)
  • Data processed: Email, user identifier, auth tokens
  • Location: United States
  • Security documentation: workos.com/security

​
AI and speech

​
Deepgram

  • Purpose: Speech-to-text
  • Data processed: Audio stream (transit); transcript text
  • Location: United States
  • Model training: Customer content is not used to train Deepgram base models unless the customer opts into model-improvement programs (Deepgram trust & privacy)
  • Security documentation: Deepgram Trust and Security

​
OpenAI

  • Purpose: Real-time coaching trigger (“Ear”) via OpenAI Realtime API (direct connection; not routed through Vercel AI Gateway)
  • Data processed: Transcript snapshots (transit)
  • Location: United States
  • Model training: OpenAI API data is not used to train OpenAI models (OpenAI data controls)
  • Abuse monitoring retention: Up to 30 days on Swell’s standard account (no Zero Data Retention approval). Application state: none for /v1/realtime.
  • Traces dashboard: Application sets tracing: null to exclude Ear sessions from OpenAI Traces (does not disable abuse-monitoring logs)
  • Security documentation: openai.com/security

​
Vercel AI Gateway

  • Purpose: LLM request routing for Brain coaching suggestions (coach-relay → Gateway → Anthropic)
  • Data processed: Transcript text and coaching context (transit)
  • Location: United States
  • Zero data retention: zeroDataRetention: true enforced on every Brain request in application code
  • Security documentation: vercel.com/docs/ai-gateway

​
Anthropic

  • Purpose: Coaching suggestions (“Brain”)
  • Data processed: Transcript text, coaching context (transit)
  • Location: United States
  • Model training: Anthropic commercial/API terms prohibit training on customer content (Anthropic commercial terms)
  • Security documentation: anthropic.com/trust
Deepgram, OpenAI, Vercel AI Gateway, and Anthropic are invoked server-side only from Swell’s coaching relay on Railway. Brain suggestions route through Vercel AI Gateway before reaching Anthropic. The Mac app does not connect directly to these providers or hold their API keys.

​
Observability

​
Sentry

  • Purpose: Crash and error reporting (Mac app, web API, coach-relay)
  • Data processed: Stack traces, app version, error context; PII disabled by default; sensitive fields scrubbed before upload
  • Location: United States
  • Security documentation: sentry.io/security

​
Distribution (Apple)

​
Apple

  • Purpose: Code signing, notarization, Gatekeeper
  • Data processed: Binaries submitted for notarization
  • Security documentation: Apple Platform Security
Apple is listed for transparency on distribution; Apple does not process call content.

​
Data flow summary

From the user’s Mac:
  • coach.tryswell.co (coaching WebSocket): split mic/system PCM audio streams and coaching events (Railway)
  • api.tryswell.co (auth, sessions, profile, appcast): Vercel
  • *.workos.com (OAuth sign-in): default system browser during login
  • Sentry (crashes): from Mac, if configured
Server-side only (coach-relay and backend):
  • Deepgram (speech-to-text): invoked from Railway
  • OpenAI (Ear): invoked from Railway
  • Vercel AI Gateway → Anthropic (Brain): invoked from Railway
  • Convex (storage): via Swell backend with JWT-bound reads and per-service sync secrets
  • Sentry (errors): from Vercel web and Railway coach-relay, if configured

​
Changes to this list

We will update this page when we add or replace subprocessors that process personal data or call content. Material changes may be communicated to active users where appropriate.