Security at Swiftt
Swiftt is designed to be simple without being careless. We use managed cloud infrastructure, encrypted connections, passwordless authentication, and database-level access controls to help protect accounts and shared list data.
Access should be intentional, limited by role, and enforced at the data layer—not only hidden in the interface.
Account security
Swiftt uses passwordless authentication options such as email magic links and supported social sign-in providers. This reduces risks associated with weak or reused passwords.
- Authentication sessions are handled by our authentication provider.
- Public browser code uses publishable client credentials only.
- Administrative credentials are not exposed in the browser.
- Additional protections such as MFA and abuse-prevention controls may be added as the service grows.
List access and permissions
Lists are private by default. Access is controlled through roles such as Owner, Can edit, and Can view. Database row-level security is used to restrict which records an authenticated user can read or change.
Deletion and recovery
Deleting a list moves it to a recovery state rather than immediately destroying the data. Owners can restore deleted lists for up to 30 days. After that recovery window, Swiftt may permanently remove the list and related records.
Backups and resilience
Swiftt's production architecture is intended to use managed database backups and additional recovery procedures appropriate to the hosting plan in use. Backups are designed for service recovery and are separate from the user-facing Recently Deleted feature.
No online service can guarantee that data will never be lost, so Swiftt should not be used as the sole repository for mission-critical or regulated information.
Infrastructure
Swiftt is built on managed application, authentication, and database infrastructure. Production traffic is intended to use HTTPS/TLS, restrictive security headers, authenticated-route cache controls, and least-privilege access patterns.
Report a security issue
If you believe you have discovered a vulnerability, contact the Swiftt team using the support contact published on the production website. Please avoid public disclosure until we have had a reasonable opportunity to investigate.