Security at Swarmify
SmartVideo has carried customer video since 2013. Here’s how we protect the data behind it — and exactly which vendors touch it, published in plain sight.
14-day free trial · Card required, no charge until day 15How We Protect Your Data
Encryption in transit
All traffic is served over HTTPS with modern TLS (1.2+) at our load balancers; plain-HTTP requests are redirected. HSTS is enabled on swarmify.com.
Encryption at rest
Our Google Cloud databases, compute disks, and storage are encrypted at rest with provider-managed keys. Application credentials and API keys are kept out of source control.
Access control
Service accounts are scoped narrowly to the resources they need, and administrative access is limited to Swarmify’s principals. Infrastructure and access grants are managed as code, so every change is tracked and reviewable.
Monitoring and alerting
Centralized logging with automated uptime, error, and resource alerting — alarms page our engineers directly.
Backups and recovery
Automated backups with point-in-time recovery on our primary database, plus a seven-day undelete window on Google Cloud object storage.
Privacy & Compliance
Privacy commitments are contractual, not marketing copy — they live in our published Data Processing Addendum and Privacy Policy.
- GDPR, UK GDPR & CCPA
- Our DPA incorporates the EU Standard Contractual Clauses (Module 2) and the UK Addendum for international transfers, and addresses CCPA/CPRA and other U.S. state privacy laws.
- 72-hour incident notification
- If a security incident involves customer personal data under our control, we commit to notifying you without undue delay — and in any event within 72 hours of becoming aware of it.
- Transparent subprocessors
- We maintain a public subprocessor list in the DPA — each vendor, what it does, and where it processes.
- EU processing
- Video encoding and caption generation run on Swarmify-operated servers in the European Union (Germany and Finland) as well as the US.
- Data lifecycle
- When you cancel, you get an export window for your content. After it closes, personal data is deleted from active systems and then from backups as they expire, per the retention terms in the DPA.
- Consent-first analytics
- Analytics on this site run under Consent Mode v2 with a default-deny posture. In the EU, UK, EEA, and Switzerland — and wherever we cannot determine a visitor’s country — no analytics cookies or identifiers are set until that visitor accepts the consent banner; elsewhere analytics storage is granted automatically, and can be withdrawn at any time from Cookie Settings.
What Runs in Your Visitors’ Browsers
The SmartVideo player is ad-free out of the box and carries no third-party analytics. Ads run only if you supply your own ad tags, and any tracking that follows comes from the ad stack you chose. Engagement data — plays, watch time, drop-off — flows only to your SmartVideo dashboard, never to a vendor-owned analytics platform. The player’s crash reporting is scoped to the player itself and deliberately blind to everything else on your page.
Production changes to the services behind it go through pull-request review and deploy through separated development and production environments.
Security FAQ
Still have questions? Get in touch or browse the help center.
Do you sign a Data Processing Addendum (DPA)?
Yes — our DPA is published and incorporated into the Master Services Agreement. It includes the EU Standard Contractual Clauses (Module 2) and the UK Addendum for international transfers.
Where is customer data processed?
Application infrastructure runs on Google Cloud in the United States (multi-region). Encoding runs on Swarmify-operated servers in the EU (Germany, Finland) and the US, and delivery uses global CDN edge locations. The full breakdown is in the DPA’s subprocessor table.
What happens to my data when I cancel?
You can export your content during the post-termination window described in the MSA. After that, we delete customer personal data from active systems and then from backups as they expire, per the retention terms in our DPA.
How do you handle security incidents?
We notify affected customers without undue delay — and in any event within 72 hours of becoming aware of a security incident involving customer personal data in our control — and provide updates to support your own incident-response and regulatory obligations.
Does the player track my visitors?
No third-party analytics, and no ad tracking unless you enable ads yourself with your own ad tags. Viewer engagement data goes to your SmartVideo dashboard only. The player’s own crash reporting is limited to player errors and never touches the rest of your page.
How do I report a security concern?
Email privacy@swarmify.com. It routes directly to the engineers who run the platform.
Have a security questionnaire?
Send it over. You’ll hear back from the people who actually run the infrastructure.
14-day free trial · Card required, no charge until day 15