Security

Last updated: September 9, 2026 · Version 2026-09-09

This page summarizes the security practices SwayForm LLC applies to the website, Learning Portal, and the data described in our Privacy Policy. It is a public summary of our written information security program, intended for school IT/procurement review — not an exhaustive technical specification.

We do not claim our systems are "100% secure," "unhackable," or "military-grade." No system can make that claim honestly, and we would rather describe what we actually do than make a promise we can't keep.

Access controls

Access to production data is limited to the people who need it to operate SwayForm's systems.
School administrator and student accounts are authenticated through Google Identity Services rather than a self-managed password system, and sessions are stored in signed, HTTP-only cookies.
Administrative actions (such as adding or removing a student, or changing admin emails) are restricted to authenticated admin sessions tied to a specific robot/school.

Encryption

Connections to the website and Learning Portal are encrypted in transit (HTTPS). Data at rest in our database provider is protected by that provider's own storage-level encryption.

Infrastructure

The website and Learning Portal are hosted on Vercel; the database is hosted on Neon. Both are established infrastructure providers that SwayForm relies on for platform-level security (network protections, patching of the underlying platform, etc.) in addition to SwayForm's own application-level controls.

Vulnerability management

We keep application dependencies up to date and address known vulnerabilities in software we rely on as they're identified. As SwayForm grows, we intend to adopt a more formal vulnerability-disclosure and patching cadence appropriate to the scale of school data we hold.

Monitoring and logging

Our hosting provider logs standard technical request data (IP address, timestamps) that we can use to investigate suspicious activity. We do not currently operate a dedicated security-analytics or intrusion-detection product beyond what our hosting and database providers offer natively; we expect to add more formal monitoring as we scale toward commercial deployment.

Incident response

If we become aware of a security incident affecting personal information, we will investigate, take reasonable steps to contain it, and provide notifications required by applicable law and any signed agreement with an affected school. See the School Data Agreement for our breach-notification commitment to schools specifically.

Data minimization

We aim to collect only the information described in the Privacy Policy. Student-written code, in particular, is stored locally (in the browser or on the robot's own storage) rather than on SwayForm's servers, which limits what a server-side incident could expose.

Insurance

SwayForm is currently evaluating cyber liability and product liability insurance appropriate to our stage of growth. This page will be updated once coverage is in place.

Contact

To report a suspected security issue, or to request a security summary for procurement purposes, contact contact@swayform.net.

SwayForm is in pilot development. As we move toward commercial release and take on more schools, we expect to formalize this program further — including a fuller internal Written Information Security Program available to schools under a signed agreement.