SecuritySecurity and compliance, built in.
You trust us with sensitive information about your clients and your organisation. We make clear commitments about how we protect it, and your procurement team can request the documents behind them.
Our commitments
What every client checks before signing.
ISO/IEC 27001
Certified information security management under ISO/IEC 27001, the international standard, with annual audits.
GDPR
Your organisation is the controller of personal data, and Swimbird acts as processor under a data processing agreement.
Data protection and hosting
Hosted in the EU/EEA, encrypted in transit and at rest. Your data stays yours, and is never used for other customers, for benchmarking or to train AI.
Access control
Role-based access with multi-factor authentication, or single sign-on through your own identity provider. You decide what each user can see.
Contractual bank data agreements
Every bank connection runs under a contractual agreement with the counterparty. No screen scraping and no shared logins.
Audit trail
A full trail from source to report, with data lineage behind every figure.
AI on your data
The AI works within each user’s existing permissions and access, with figures calculated by Swimbird rather than by the model, and an audit trail of every request.
For your outsourcing assessment
Banks in the EU assess a provider like Swimbird under DORA, the Digital Operational Resilience Act, and the EBA guidelines on outsourcing.
Exit plan and data return
We agree an exit and transition plan with you. When the agreement ends, we support the full extraction of your data in structured formats, then delete or anonymise it within the agreed retention periods.
Audit and access rights
We support audit, access and information rights for your bank and for your supervisor, written into the agreement.
Incident notification
We notify you without undue delay of any incident that may affect your data, as the agreement sets out. Continuous monitoring, automated alerting and an established incident process sit behind it.
Business continuity
Documented business continuity and disaster recovery, with recovery objectives agreed with you and tested. Encrypted backups stay in the EU/EEA.
Sub-processors
We review every sub-processor for what it does and where it processes data, list them for you, and notify you of any change.
Available to your procurement team on request
- ISO/IEC 27001 certificateOur certification and its scope.
- Statement of applicabilityThe ISO/IEC 27001 controls we apply.
- Penetration test summaryFrom our latest external test.
- Data processing agreementSwimbird as your processor under GDPR.
- Sub-processor listWho processes data for us, what for and where.
- Business continuity summaryRecovery objectives, backups and testing.
- Outsourcing statementOur answers for your outsourcing assessment.
Questions our clients ask
Wealth platforms are chosen on trust.
Where does the data come from, and can we check it?
NEST collects it from your banks, custodians, files and fund documents, reconciles it every day, and keeps audit trails and data lineage.
How NEST worksHow is our clients’ data protected?
Swimbird is ISO/IEC 27001 certified and hosts your data in the EU/EEA. You own your data, including everything derived from it.
Can our clients see it under our brand?
Yes. SWIP can carry your brand and your sign-in. Swimbird is a software provider: you keep the client relationship, the advice and your fiduciary responsibilities.
Swimbird for banksWho does the work of getting started?
We do. We map and load your data, connect your banks and custodians, train your users, and give you a dedicated key account manager.
How getting started works
Questions from your risk or IT security team? Send questionnaires to sales@swimbird.se.
Request our security documentation
Tell us what your procurement process needs. We’ll send the documents and answer your team’s questionnaires.
Prefer email? sales@swimbird.se