ISO/IEC 27001:2022
The international standard for information security management. Microsoft Azure is certified by an accredited independent auditor and re-audited every year.
Security
Careful with your directory.
Swyft Signature reads a few profile fields so it can write signatures. Here is how that data is kept safe, and where it lives.
01Practices
Defence in depth.
01
Tenant isolation
Every request is scoped to the signed-in organisation, and every database query carries that organisation's ID. One customer can never reach another's data.
02
Administrators only
Only the Swyft administrators your organisation names can change templates, rules or settings. Everyone else can only receive their own signature.
03
Read-only directory access
Three read-only Microsoft Graph permissions, or read-only Google Workspace directory scopes plus Gmail signature settings. No access to mail, files or calendars.
04
Secrets in Key Vault
Keys and connection details live in Azure Key Vault and are read by the application's managed identity, never stored in code.
05
Clean templates
Signature HTML is sanitised on save and on display, and directory values are escaped, which blocks script injection.
06
Private by network
The application only accepts traffic through Azure Front Door with a web application firewall, and outbound traffic passes through a firewall.
07
Rate limits and bot checks
Public endpoints are rate limited, and the contact form uses a Cloudflare Turnstile check instead of tracking cookies.
08
Audit log
Changes to templates, rules and settings are recorded with the administrator and time.
02Infrastructure
Where your data lives.
Personal data is stored and processed inside the European Union. Nothing is sold, and directory data is never shared with advertisers.
- Cloud
- Microsoft Azure
- Application
- West Europe (Netherlands), EU
- Database
- Azure SQL Database, Germany West Central (Frankfurt), EU, private network only
- Secrets
- Azure Key Vault
- Edge
- Azure Front Door with web application firewall
- Sign-in
- Microsoft Entra ID or Google
- Payments
- Stripe
- Resend
03Certified infrastructure
Built on audited infrastructure.
Swyft Signature runs entirely on Microsoft Azure, whose cloud services and data centres are independently audited every year. Microsoft publishes its certificates and audit reports for anyone to check.
SOC 2 Type 2
An independent examination of security, availability, processing integrity and confidentiality controls over time, carried out on Microsoft Azure by a certified public accounting firm.
Hosted in the EU
The application runs in Azure West Europe and the database in Germany West Central. Microsoft's Data Protection Addendum covers how Azure processes data for us.
These certifications are held by Microsoft and cover the Azure infrastructure that hosts Swyft Signature. Swyft Software Limited is not itself certified to ISO/IEC 27001 or SOC 2. Microsoft's full certificates and reports are in its Service Trust Portal, which asks you to sign in with a Microsoft account.
04GDPR
Your rights, respected.
Access, correction, erasure and portability requests are handled through our privacy centre. Your organisation remains the controller of its staff data, and Swyft Signature acts as its processor.
Questions from your security team?
We are happy to answer them before you start.