Secure by design

Consistent protection from sign-in to output.

SwiftTool combines account, permission, file, infrastructure and audit controls. No internet service can promise absolute security, so controls are reviewed and updated.

Accounts and sessions

Argon2id passwords, randomly generated session tokens stored as hashes, expiry and per-device revocation.

Identity-provider verification

Google OAuth with state and PKCE, plus signature verification before Telegram identity linking.

Restricted database access

Website tables use a dedicated prefix and the VIP bridge accesses only the required record.

Restricted internal services

Docker and VIP actions pass through fixed allowlist wrappers rather than arbitrary shell access.

Responsible reporting

Do not include passwords, tokens or third-party personal data. Send a description, route and reproduction steps through Support.

Report to support

Read the full privacy and security document