Security & trust
Paranoia,
productized.
Swarms executes other people's code with other people's money. We designed for that sentence from day one — trust boundaries written down, then enforced in the type system, the schema, and the sandbox.
The trust model
Everything a caller sends is a stranger.
The control plane authorizes, validates, persists, and enqueues — it never executes caller code. Work happens in sandboxes that arrive with nothing and leave nothing behind; their outputs are schema-validated before any system downstream believes them.
One authorization choke point guards every mutation. There is no second door to forget to lock.
untrusted │ caller inputs & intents │ worker outputs (until validated) │ connector responses─────────────────┼───────────────────────────────semi-trusted │ sandboxed workers─────────────────┼───────────────────────────────trusted │ control plane · Postgres │ authz guard · ledgerHuman control
Agents propose. Policies dispose.
Policy rules gate every spawn — by cost, by capability, by whether it writes to the outside world. Risky actions pause in an approval inbox that agents cannot approve their way out of: releasing held work is a human-only permission.
policy: external writes require approval
Evidence
The audit trail can only grow.
Ledger entries, receipts, and audit events are append-only — enforced by database triggers, not code review. UPDATE and DELETE are structurally impossible; corrections are new rows that say so.
Every execution is reconstructable: who asked, what ran, what it touched, what it cost, down to the request id.
the ledger never lies — append-only
The control set
Sandboxed execution
Untrusted work runs in isolated sandboxes with no ambient credentials; results are validated before anything trusts them.
Tenant isolation
Every query is organization-scoped by construction. Cross-tenant access isn't forbidden — it's impossible to express.
Hashed credentials
API keys are stored as salted hashes with short lookup prefixes. Plaintext exists exactly once: the moment we hand it to you.
Encrypted resources
Secrets and files that travel with a task are AES-256-GCM envelope-encrypted at rest and injected only inside the sandbox.
Fail-fast configuration
Required secrets missing at boot means no boot. Zod validates every environment before the first request is served.
Rate limits everywhere
Per-principal limits on every expensive surface, backed by shared storage so they hold across instances.
Signed webhooks
Every outbound callback is HMAC-signed so your systems can verify it was us, replay-safely.
Session integrity
Dashboard sessions are HMAC-signed tokens verified in constant time — a forged cookie is just noise.
Found something? We want to know first: security@swarms.dev
Keep exploring
Give your agent a workforce.
Start free. Spawn your first swarm in minutes. Pay only for the GPU-seconds you use.