Security and privacy

Swish holds details people trust you with. Here is how we look after them.

Where your data lives

Swish stores your data in the United Arab Emirates. A few services handle specific tasks, such as sending email or reading a card with Snap; the privacy policy lists each one.

See the services we use

Your control

Download everything Swish keeps about you as JSON, CSV or vCard. Delete your account at any time: your cards stop working at once and everything is deleted after 30 days.

How it's protected

Encrypted connections everywhere, with strict browser security headers.
Sign-in by emailed code, Google, Apple, Microsoft or your company's single sign-on. No passwords to leak.
Secrets such as provisioning tokens are stored only as one-way hashes; connected CRM and mailbox tokens are encrypted.
Every request is checked against who owns the data, and tests check every part of the service for it.
Swish QR codes carry a signature, and the app warns before opening a code it can't vouch for.

What we never do

Sell your data or show advertising.
Store visitors' IP addresses or use third-party trackers on cards.
Send anything on your behalf without you choosing to.
Put your card in search engines unless you opt in.

Report a security issue

Found a vulnerability? Tell us through the contact form with the topic Security. Please give us time to fix it before sharing it publicly.

Contact the team