Security
How the application is built.
Billswarm processes the most sensitive document a CPA firm produces in a month, its billing PDF. We design every part of the application around keeping that document private, intact, and traceable. This page describes the architecture and the controls every deployment ships with — the commitment we hold ourselves to.
What this site is, and isn’t
This is billswarm.com, the marketing site. It processes no customer data; it has no database, no PII, and only cookieless page analytics. The Billswarm application is deployed into each customer firm’s own AWS environment — your firm owns the deployment — and is governed by the agreement signed with your firm. The controls below are the architecture every deployment ships with.
Encryption
- At rest
- AES-256 on all customer artifacts: uploaded PDFs, derived per-client packets, generated XLSX, audit records, and database backups.
- In transit
- TLS 1.2+ enforced end-to-end, with HSTS on every deployment's application domain.
- Key management
- AWS KMS, customer-managed keys with rotation per AWS guidance.
Isolation
- Deployment isolation
- The application is deployed into your firm's own AWS environment. Your data never shares infrastructure with another firm.
- Row-level security
- Inside each deployment, isolation is additionally enforced at the database layer (PostgreSQL RLS), not at the application layer. A query missing a tenant predicate returns zero rows.
- Storage
- Per-tenant object prefixes; signed URLs scoped to the requesting tenant.
Audit log
- Capture
- Every action is recorded with actor, timestamp, and rationale: upload, line edit, flag triage, approval, write-off, and export.
- Integrity
- Append-only. Audit records are not deletable or editable from the application surface.
- Retention
- Audit records live in your firm’s environment and are retained per your firm’s document-retention policy.
Least-privilege access
- Default posture
- The application runs in your firm's own AWS account. Billswarm engineering has no standing access to your data; any access is scoped, granted by your firm, and logged.
- Elevated access
- Short-lived, scoped to incident response, every session logged.
- Background checks
- Planned for all personnel with deployment access as the team grows.
Subprocessors
- Posture
- Short and deliberate. Current list provided to customers in the order form; updated when it changes; customer notification on material additions.
- Client-data sub-processors
- The application deploys into your firm's own AWS account — RDS (Postgres), S3, and KMS. Model inference runs through Amazon Bedrock (the default in-AWS path) or Anthropic. Customer data is not used to train shared models.
Vulnerability reporting
- Channel
- austin.eisenman@billswarm.com. We acknowledge within two business days; status update within five.
- Safe harbor
- Good-faith research conducted within the scope below is welcome; we will not pursue legal action against researchers who act in good faith.