Security & trust
Swarmfile is built so that the things that should be private stay private - even from us. This page is honest about what's built and what's on the roadmap.
ShippingWhat's built
AES-256-GCM encryption at rest
Every tier stores ciphertext. By default, per-project keys are managed centrally and wrapped by a hub-held KEK, so the hub can decrypt to generate previews - managed encryption protects your data at rest, not from Swarmfile itself. For that, use the end-to-end tier.
Opt-in end-to-end encryption
For teams that need it, an opt-in tier wraps each project key to your members’ own device keys, so it never reaches our servers in plaintext - with an org recovery key you hold. Content-only: filenames and sizes stay searchable; server-side previews turn off in exchange.
Content-addressed integrity
Every block is BLAKE3-verified on arrival. Corrupt data from a misbehaving peer or transport never reaches the application layer.
Signed & notarized binaries
Every release is code-signed and verified before it ships: macOS builds carry an Apple Developer ID signature and a stapled notarization ticket, Windows builds are Authenticode-signed. A pre-publish gate checks the signature on the artifact a user actually runs - not just the build inputs - so the installer is verifiably ours, not a look-alike.
Reed-Solomon 10+4 erasure coding
Adaptive per-chunk shard distribution. The first 10 shards reconstruct the data, so up to 4 slow or offline peers don't slow you down.
Per-org tenant isolation
Every organization gets its own database - a dedicated Durable Object with its own SQLite store - plus an isolated per-organization storage namespace within the shared block store, keyed so one org's blocks are never reachable from another's. Cross-tenant access is structurally impossible.
No kernel extension on macOS
The macOS installer ships our kext-free build (FUSE-T), which mounts entirely in user space - no kernel extension, no booting into Recovery to lower to “Reduced Security,” and no system-extension approval on Apple Silicon. This has been the default since our 2026-07-02 release; the legacy macFUSE path remains in the codebase as a fallback build target but isn’t what the public installer ships.
Folder & file ACLs
Per-project grants (read / write / admin, allow / deny, inherited). Resolution walks ancestors via a recursive CTE; deny anywhere wins. Owners bypass. Projects can be open or protected mode.
Directory sync (SCIM + LDAP)
Bring your own identity provider. SCIM 2.0 bearer tokens, Entra and Okta PATCH dialects, plus a customer-deployed LDAP agent for on-prem AD.
Multi-IdP per tenant
Per-org external IdP config with hard-binding. JWTs are validated against the right JWKS by issuer. Owner-only break-glass via the Swarmfile IdP.
Project-scoped API keys
Headless engines - render farms, CI, NAS nodes - authenticate with a project-scoped API key that is structurally unable to reach any other project, and can be revoked instantly. It replaces copying a real user’s token onto every machine, which carried that user’s full account access.
Hardened identity provider
Our built-in IdP is built against credential attacks: enumeration-safe registration, per-account exponential lockout on repeated failures, per-IP rate limiting on every auth-gated path, ES256 JWTs, and refresh-token rotation with replay detection.
Ransomware detection
Inline high-frequency CID-overwrite detection auto-quarantines a compromised user. Lock acquire and renew also check quarantine state.
Versioned history & rollback
Every change is timestamped. Roll back to any point in time. Soft-delete + trash retention give you 1-3650 days of recovery window per user.
Unified activity feed
ACL changes, history events, quarantine incidents, org audit, notifications and unlock requests in one feed (dashboard Activity tab), open to any member - ACL-filtered server-side so members see only events on entries they can read. Live SSE tail; CSV export (100k-row cap) is owner-only. Cross-system SIEM export remains on the roadmap.
Share links with caps
Optional PBKDF2 password gate, expiry, access-count limits, atomic counter to prevent TOCTOU bypass. JWT session cookie for authenticated previews.
Verified-recipient share links
Every public share link now requires the recipient to confirm a one-time emailed link before any content - download, preview, or comments - is served, on top of any password. A 30-day session means a returning collaborator isn’t re-gated on every visit. The share’s owner gets a full log of verified recipients and can block one at any time; a block takes effect on their very next request.
Hub-only data-plane mode
For enterprises that block UDP/QUIC entirely, or that need to eliminate peer IP exposure: an org-level data-plane policy (or the engine-local SWARMFILE_HUB_ONLY toggle) disables peer-to-peer at startup. QUIC never binds, no peer discovery or gossip, swarmfile doctor reports clean. Reads fall through to HTTPS/R2. Owner-gated and audited.
Private P2P swarm
Our peer-to-peer transport runs in a private swarm - joining requires a pre-shared key and a custom protocol identifier. Random hosts on the internet can’t dial in to your blocks.
Connectivity diagnostics
swarmfile doctor - a single-binary CLI that walks enterprise IT through proxy, firewall, and DNS checks before they spend hours debugging. Colourised pass / warn / fail for the screen, JSON for ticket attachment. Also runs from the tray (Diagnostics → Run Doctor…) and periodically in the background, with a hub-side /healthz/deep for round-trip probing.
Download for Linux: swarmfile-doctor-x86_64-unknown-linux-gnu
Where your data lives - and what you run yourself
This comes up in every security review, so we’re direct about it: which parts of Swarmfile can run on infrastructure you control.
Your bulk data, on your hardware
Even on the standard hosted plan. A seed node keeps a full local copy of a project’s data on your hardware, and LAN-first moves bytes machine-to-machine over your own network - so a team with a seed node in the building serves most reads from its own hardware, not a round trip to our cloud. On the default managed tier that data is encrypted, and reading it still depends on a key fetched live from our hub - a fast local cache, not an offline-independent copy.
The control plane, hosted by default
Metadata, permissions, identity, and the coordination that lets machines find each other run as a managed service. Stored blocks are always encrypted; with the opt-in end-to-end tier it can’t read your content at all. Most teams run this hosted.
Self-hostable control plane, on Enterprise
Need the coordination layer inside your own perimeter, up to a fully air-gapped deployment? On Enterprise the control plane runs entirely on infrastructure you control - the same code, not a fork or a lesser rewrite. Data residency and custom data-handling terms are Enterprise too. Raise it early in procurement so it gets scoped correctly.
Full detail in Deployment Topologies, or talk to us about a self-hosted or air-gapped deployment.
PlannedWhat’s on the roadmap
We don’t claim certifications or features we don’t have. Here’s what we’re building next.
SOC 2 Type I
On our roadmap. Today we complete security questionnaires, share our full architecture, and map controls directly with your security team - and Type II follows once Type I is issued.
SIEM forwarding
Splunk / Datadog / S3 export of audit, access, and quarantine event streams. Today these live in per-tenant databases only.
Legal hold & retention immutability
Per-entry legal-hold flag that overrides retention and trash purge. Retention-window immutability with audit.
DLP & egress controls
Watermarking, share-link domain allow-lists, Pack-&-Go export policy gating for regulated content.
Security questions?
We answer security questionnaires and walk through architecture with your team. Pre-sales is included on every plan.