Security and privacy in Swashi
How Swashi protects your account and data: two-factor sign-in, secure connections, safe payments, data isolation, Business Brain checks and email compliance.
Swashi protects your account with two-factor sign-in, secure connections and strict separation between customers. Your data is stored securely and encrypted, payments are handled by Stripe, and each account can only ever see its own leads, campaigns, replies and calls.
This page explains what Swashi does to protect you, and the steps you can take yourself.
Protect your account
Turn on two-factor authentication
- Open User Settings.
- Under Two-Factor Authentication, turn on Email verification on login.
- From then on, a 6-digit code is sent to your email every time you sign in.
Change your password safely
Password changes are confirmed with a 6-digit code sent to your account email. New passwords must be at least 8 characters. See Settings.
Secure the chatbot
When you connect the Swashi bot on LINE, WhatsApp or Telegram, you verify your account with your email address and a 6-digit code. Verification lasts 30 days, after which you may be asked to verify again. The Bot Security Center in Settings adds a security code that the bot asks for before destructive commands, such as deleting a site. Rotate the code anytime. The old code then stops working.
Important:Swashi will never ask for your password or card number in a chat, an email or a call. The only credentials you enter are an app password or API key for your sending mailbox, and only in the official app screen. If anyone asks for more, contact support@swashi.io.
How your connections are protected
| Connection | How it works |
|---|---|
| LinkedIn, Facebook, Instagram, X | Connected through each network's official sign-in. Swashi never stores your social media passwords. |
| Google Search Console | Connected read-only through Google sign-in. Swashi stores only the access token, never your password. You can revoke access anytime from your Google Account under Security, then Third-party apps. |
| Google Calendar | Read-only. Swashi shows your upcoming events and checks whether a time is free when a caller asks. It never creates, changes or deletes events and never stores their details. |
| Gmail | Connected with an App Password, which is separate from your normal Google password. Never enter your main Gmail password. |
| Brevo, SendGrid, SMTP | Connected with an API key or SMTP login that you control. |
| Payments | Handled by Stripe. Swashi never stores your card details. |
Your data stays yours
- One account, one dataset. Every view, inbox and report shows only your own account's data. The Unified Inbox only ever shows your own replies.
- No sharing between customers. Swashi never shares one user's personal data, leads, campaigns or account details with another user.
- No cross-customer learning. Your Business Brain and results shape your own agents. They are not applied to another customer's outputs.
- Verified sessions only. Account data is only available in a verified, signed-in session, including in the chatbots.
What goes into your Business Brain
Every file uploaded to the Business Brain is checked before it is stored. Adult, illegal, drug or gambling content is refused and never stored. You choose which outputs each file trains (Social, Website, Email or Voice), and you can delete a file at any time. See Business Brain.
Responsible email sending
Swashi protects both your recipients and your sender reputation:
- An unsubscribe link is added to every outreach email, along with one-click unsubscribe headers.
- Your suppression list is checked before every send. People who unsubscribe are never emailed again.
- Every address is validated before sending, and every email gets a spam trigger scan and a content safety check.
- A campaign pauses automatically if its bounce rate reaches 5%.
- New mailboxes are warmed up gradually, and every send is paced rather than sent in bursts.
See Compliance and unsubscribe and Deliverability and warm-up.
Calls and recordings
Your AI Receptionist and voice campaigns log each call's transcript, recording and outcome. You can see them in Voice Outreach and on the Business page. Only your account can see your calls.
Honest numbers
Swashi never makes up a figure. When something cannot be measured yet, you see Not measured. When a figure could not be loaded, you see Unavailable. Neither is ever shown as zero.
Cancellation and your data
If you cancel, your account moves to the Free plan when the paid period ends, and your data stays in it. Nothing is deleted automatically. You can ask for your account and data to be deleted at any time by contacting support@swashi.io (see the Privacy Policy). See Plans and billing.
Learn more
- Read the Privacy Policy and Terms of Service.
- See how Swashi uses Google data on the Google API compliance page.
- For a security concern, contact support@swashi.io.
Frequently asked questions
Is my data secure with Swashi?+
Your data is stored securely and encrypted. Every account sees only its own data, payments are handled by Stripe, and social and Google connections use the networks' official sign-in, so Swashi never sees those passwords.
Does Swashi store my credit card?+
No. All payments are handled by Stripe. Swashi never stores your card details.
Will Swashi ever ask for my password?+
No. Swashi never asks for your passwords or card numbers in chat, email or on calls. The only credential you enter is an app password or API key for your email account, and only in the official app screen.
Is my Business Brain used to train other customers' AI?+
No. What you put in your Business Brain is used for your account. Swashi does not apply one customer's data to another customer's outputs.
Can Swashi edit my Google Calendar?+
No. Calendar access is read-only. Swashi shows your upcoming events and checks whether a time is free; it never creates, changes or deletes events.