Swan

Swan is SOC 2 compliant. On SOC2C this listing is Listed.

Yes. Swan's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.

Swan hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.

Security isn't a single yes/no, but Swan is SOC 2 compliant. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Swan hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@swan.io or via a /security page (Swan lists a security contact).

All customer content is hosted in Amazon AWS Public Cloud. Our whole infrastructure is hosted on AWS Public Cloud located in eu-west-1 zone, Ireland. Where disasters would occur causing damage against AWS Data center, Swan would be able to redeploy its infrastructure onto a distinct hosting location as infrastructure-as-code mechanisms are in use.

Swan runs an ongoing security management program to ensure that its security measures are aligned with the level of risk. This program is guided by risk assessments and utilizes both internal resources and specialized security third-parties. It includes: - Black box penetration testing at least twice a year - Bug bounty programs - Red team exercises - Continuous vulnerability scanning - Systematic peer reviews for each code release - Developers are trained on an annual basis and during onboarding against common development vulnerabilities, using OWASP and Mitre CWE recommendations - The security team performs internal architecture reviews for projects and new features that are sensitive to security concerns Swan aims to address vulnerabilities within 14 days for critical severity, 30 days for high severity, and 60 days for medium severity.

As a financial institution, Swan is complying with DORA (Digital Operational Resilience Act). We are continuously working to maintain our compliance level with DORA. Swan is also certified for ISO/IEC 27001:2022. As the holder of an EMI license, also licensed to provide payment services, Swan comply with all applicable regulatory requirements set out in PSD2, including : strong governance, capital requirements, internal control and risk management, etc.

Swan is not PCI DSS certified because it is not necessary for our business. Swan does not store, process or transit cardholder data (payment card numbers). For payment services, Swan relies on Monext to handle cardholder data and process payments. Monext is PCI DSS certified. For card issuing services, Swan relies on Idemia to handle the issuing of payment cards. Idemia is PCI DSS certified. Swan is currently working on an accept payments project with Checkout as a Acquirer & Gateway. Checkout is PCI DSS certified, and for the scope of this project, Swan is PCI DSS SAQ A-EP compliant.

All customer data is encrypted at rest at any time. We currently use AWS's standard mechanisms and AES 256 is the main standard in use. Backups are also encrypted through AWS's standard mechanisms.