Skip to main content
Security is the cornerstone of the Swarms platform. We maintain an unwavering commitment to the most rigorous security standards in the industry, implementing defense-in-depth strategies that protect your data, applications, and infrastructure at every layer. Our platform undergoes continuous security assessments, holds multiple industry-leading compliance certifications, and employs enterprise-grade controls that meet and exceed regulatory requirements across healthcare, financial services, government, and critical infrastructure sectors. Every API request, every agent execution, and every data transaction is protected by the same security architecture trusted by the world’s most demanding organizations.

​
Compliance

We maintain the following security certifications and compliance standards:

SOC 2 Type 2

Certified for security, availability, processing integrity, confidentiality, and privacy controls.

SOC 3

Public-facing report demonstrating our commitment to security and operational excellence.

HIPAA

Compliant with Health Insurance Portability and Accountability Act requirements for healthcare data.

GDPR

Compliant with General Data Protection Regulation for European Union data protection standards.

EU-US DPF

Certified under the EU-US Data Privacy Framework for transatlantic data transfers.

Swiss-US DPF

Certified under the Swiss-US Data Privacy Framework for data transfers between Switzerland and the US.

​
Technical Security Controls

The following controls are implemented in the API and verifiable directly from its behavior.

​
Authentication

  • Requests must include your API key in the x-api-key header. As a convenience for OpenAI-SDK-compatible clients, Authorization: Bearer <key> is also accepted and treated the same as x-api-key.
  • Requests missing both fail with a 401 authentication_error before any application logic runs.

​
Public Endpoints

Only the following paths are reachable without an API key: /, /health, /docs, /openapi.json, /redoc, and the Swagger UI assets. Every other endpoint requires authentication.

​
Security Response Headers

Every response — including error responses such as 401s and 402s — carries this header set:

​
Credit and Premium Gating

Billable and premium-only endpoints are checked before any work runs: billable routes require a total credit balance above $1.00 (402 if not), and premium-only routes require an active premium subscription (403 if not). See Pricing and Premium Endpoints.

​
Security Commitment

Our security certifications demonstrate our ongoing commitment to:
  • Data Protection: Comprehensive safeguards for all data processed through our platform
  • Privacy Compliance: Adherence to international privacy regulations and frameworks
  • Operational Excellence: Regular audits and assessments to maintain security standards
  • Transparency: Public reporting on our security practices and controls
  • Enterprise Readiness: Security measures designed for enterprise-scale deployments
These certifications are regularly audited and maintained to ensure continuous compliance with evolving security standards and regulations.