Contact: hello@tryswell.co Swell (San Gregorio Labs Inc.) uses the following third-party service providers (“subprocessors”) to operate the Service. This list applies to personal data and call content processed on our behalf. We review subprocessors for security and privacy practices appropriate to their role. Our standard DPA is available to download directly. Enterprise customers requiring notification of subprocessor changes should contact hello@tryswell.co.
Infrastructure and platform
Vercel
- Purpose: REST API hosting, auth proxy, transcript purge cron, Sparkle appcast
- Data processed: Account tokens (transit), API metadata, session sync
- Location: United States
- Security documentation: vercel.com/security
Railway
- Purpose: WebSocket coaching relay at
coach.tryswell.co(real-time audio ingress, speech-to-text, and AI coaching) - Data processed: Audio streams (transit), transcript text, session metadata, coaching state
- Location: United States
- Security documentation: Railway Trust Center
Convex
- Purpose: Database (profiles, session storage)
- Data processed: Email, user ID, transcripts, coaching data (temporary)
- Location: United States
- Security documentation: convex.dev/security
Upstash
- Purpose: Distributed rate limiting (auth and LLM-cost paths)
- Data processed: User IDs, rate-limit counters (metadata)
- Location: United States or EU (region-dependent)
- Security documentation: upstash.com/trust
Authentication
WorkOS
- Purpose: User authentication (Google OAuth via AuthKit)
- Data processed: Email, user identifier, auth tokens
- Location: United States
- Security documentation: workos.com/security
AI and speech
Deepgram
- Purpose: Speech-to-text (Deepgram Nova-3)
- Data processed: Audio stream (transit); transcript text
- Location: United States
- Model training: Swell is not opted into Deepgram’s model-improvement programs. Customer content is not used to train Deepgram base models (Deepgram trust & privacy)
- Security documentation: Deepgram Trust and Security
Vercel AI Gateway
- Purpose: LLM request routing for coaching decisions and tip writing (coaching relay → Gateway → Anthropic)
- Data processed: Available call transcript, latest exchange, previously shown tips (transit), and a user identifier for request attribution
- Location: United States
- Zero data retention:
zeroDataRetention: trueenforced on every Gateway coaching request in application code; routing pinned to Anthropic - Security documentation: vercel.com/docs/ai-gateway
Anthropic
- Purpose: Coaching decision and tip writing in one request (Claude Opus 5.5 Fast)
- Access: Invoked only via Vercel AI Gateway; Swell does not call Anthropic directly
- Data processed: Available call transcript, latest exchange, and previously shown tips (text, not call audio)
- Location: United States
- Model training: Anthropic commercial/API terms prohibit training on customer content (Anthropic commercial terms)
- Zero data retention: Every coaching request to Anthropic is routed through Vercel AI Gateway with
zeroDataRetention: trueenabled in application code - Prompt caching: Five-minute ephemeral prompt-cache entries are enabled for service delivery; this is separate from Swell’s 24-hour application retention
- Security documentation: anthropic.com/trust
Deepgram, Vercel AI Gateway, and Anthropic are invoked server-side only from Swell’s coaching relay on Railway. Audio goes to Deepgram for transcription; coaching requests send text through Vercel AI Gateway to Anthropic. The Mac app does not connect directly to these providers or hold their API keys.
Swell Practice tool only
The provider in this section processes data only for the Swell Practice browser tool, which is open only through named links. It receives nothing from the Swell Mac app.OpenAI (Swell Practice tool only)
- Purpose (practice tool only): plays the AI prospect in practice calls through the OpenAI Realtime API
- Data processed (practice tool only): the practice user’s microphone audio during a practice call, and the fictional scenario instructions that define the prospect
- Access (practice tool only): the browser connects to OpenAI directly for call audio (WebRTC); Swell’s practice server creates the call with Swell’s key, which never reaches the browser
- Location: United States
- Model training: OpenAI API data is not used to train OpenAI models by default (OpenAI: your data)
- Retention (practice tool only): no application state for Realtime calls; OpenAI’s abuse-monitoring logs are kept for up to 30 days. Swell has not enabled OpenAI Zero Data Retention for the practice tool
- Security documentation: trust.openai.com
Observability
Sentry
- Purpose: Crash and error reporting (Mac app, web API, coaching relay)
- Data processed: Stack traces, app version, error context; PII disabled by default; sensitive fields scrubbed before upload
- Location: United States
- Security documentation: sentry.io/security
Distribution (Apple)
Apple
- Purpose: Code signing, notarization, Gatekeeper
- Data processed: Binaries submitted for notarization
- Security documentation: Apple Platform Security
Data flow summary
From the user’s Mac:coach.tryswell.co(coaching WebSocket): split mic/system PCM audio streams and coaching events (Railway)api.tryswell.co(auth, sessions, profile, appcast): Vercel*.workos.com(OAuth sign-in): default system browser during login- Sentry (crashes): from Mac
- Deepgram (speech-to-text): invoked from Railway
- Vercel AI Gateway → Anthropic (coaching decision and tip writing, Claude Opus 5.5 Fast): invoked from Railway
- Convex (storage): via Swell backend with JWT-bound reads and per-service sync secrets
- Sentry (errors): from Vercel web and Railway coaching relay