Security & trust

Paranoia,
productized.

Swarms executes other people's code with other people's money. We designed for that sentence from day one — trust boundaries written down, then enforced in the type system, the schema, and the sandbox.

The trust model

Everything a caller sends is a stranger.

The control plane authorizes, validates, persists, and enqueues — it never executes caller code. Work happens in sandboxes that arrive with nothing and leave nothing behind; their outputs are schema-validated before any system downstream believes them.

One authorization choke point guards every mutation. There is no second door to forget to lock.

the boundary, in one table
untrusted        │ caller inputs & intents                 │ worker outputs (until validated)                 │ connector responses─────────────────┼───────────────────────────────semi-trusted     │ sandboxed workers─────────────────┼───────────────────────────────trusted          │ control plane · Postgres                 │ authz guard · ledger

Human control

Agents propose. Policies dispose.

Policy rules gate every spawn — by cost, by capability, by whether it writes to the outside world. Risky actions pause in an approval inbox that agents cannot approve their way out of: releasing held work is a human-only permission.

policy: external writes require approval

agent requests: send 240 emails via connector
held for approval — nothing sent
executed · logged to the audit trail

Evidence

The audit trail can only grow.

Ledger entries, receipts, and audit events are append-only — enforced by database triggers, not code review. UPDATE and DELETE are structurally impossible; corrections are new rows that say so.

Every execution is reconstructable: who asked, what ran, what it touched, what it cost, down to the request id.

the ledger never lies — append-only

holdreserved before the run−$3.00
charge43 GPU-seconds metered−$0.86
releaseunused hold returned+$2.14
receiptsigned, immutable, yours·

The control set

Sandboxed execution

Untrusted work runs in isolated sandboxes with no ambient credentials; results are validated before anything trusts them.

Tenant isolation

Every query is organization-scoped by construction. Cross-tenant access isn't forbidden — it's impossible to express.

Hashed credentials

API keys are stored as salted hashes with short lookup prefixes. Plaintext exists exactly once: the moment we hand it to you.

Encrypted resources

Secrets and files that travel with a task are AES-256-GCM envelope-encrypted at rest and injected only inside the sandbox.

Fail-fast configuration

Required secrets missing at boot means no boot. Zod validates every environment before the first request is served.

Rate limits everywhere

Per-principal limits on every expensive surface, backed by shared storage so they hold across instances.

Signed webhooks

Every outbound callback is HMAC-signed so your systems can verify it was us, replay-safely.

Session integrity

Dashboard sessions are HMAC-signed tokens verified in constant time — a forged cookie is just noise.

Found something? We want to know first: security@swarms.dev

Keep exploring

Give your agent a workforce.

Start free. Spawn your first swarm in minutes. Pay only for the GPU-seconds you use.