Documentation

Administration

Security

Swifbit is built for organizations that cannot compromise on control. Everything runs inside your infrastructure, under your rules.

Identity & sessions

  • Persistent login throttling and account lockout after repeated failures
  • Revocable sessions — invalidate a member’s active sessions on demand
  • “Sign out everywhere” from the account page
  • Strong password policy for setup and member creation
  • Automatic redirect to sign-in when a session is revoked or expires

Permission-aware retrieval

Team-based source access is enforced server-side throughout retrieval — search, document reads, citations, and AI context. Members only ever see knowledge their teams allow.

Encrypted credentials

AI provider API keys and connector secrets are sealed with authenticated encryption (AES-256-GCM) using your SWIFBIT_ENCRYPTION_KEY. Configuration responses are masked and never return stored secrets.

Hardened HTTP

  • Content Security Policy and anti-framing headers
  • Same-origin enforcement for state-changing requests in production
  • Secure, same-site cookies in production
  • Referrer and permissions policies applied to every response

Process isolation

Connectors run in isolated child processes with a minimal environment, so third-party connector code never inherits server secrets.