Security
How the application is built.
Billswarm processes your firm’s billing PDF, a document with every client name and fee on it. We design the application to keep that document private, intact, traceable, and inside your own account. This page describes the architecture and the controls every deployment ships with.
Scope of this page
This is billswarm.com, the marketing site. It has no database and holds no customer data; the only measurement is cookieless page analytics. The Billswarm application runs in each customer firm’s own cloud and network, owned by that firm and governed by the agreement it signed. The controls below describe that application.
Encryption
- At rest
- AES-256 on all customer artifacts: uploaded PDFs, derived per-client packets, generated XLSX, audit records, and database backups.
- In transit
- TLS terminates at the edge of your deployment, and on the AWS load-balancer path the policy is TLS 1.3. HTTP redirects to HTTPS and HSTS is set on the application domain. The application reaches the database over TLS with certificate verification, and the hop from the edge to the application stays inside your own network.
- Key management
- On the AWS reference deployment, AWS KMS customer-managed keys with rotation per AWS guidance.
Isolation
- Deployment isolation
- The application is deployed into your firm's own cloud and network. Your data never shares infrastructure with another firm.
- Row-level security
- Inside each deployment, PostgreSQL row-level security enforces isolation in the database itself, with FORCE applied so even the table owner is bound by it. A query that forgets its tenant filter still returns only your firm's rows, and a connection with no tenant set returns none.
- Storage
- Uploaded PDFs and exports are stored per run inside your deployment. On the VM path they sit on the application host's volume, and on-prem hosts inherit the firm's own disk encryption; on the load-balancer path they sit in one S3 bucket encrypted under your firm's KMS key, whose policy rejects any write that does not use it. A download is served only after the run clears row-level security and the requester's assignment check; on S3 the link is a signed URL that expires in 60 seconds.
Audit log
- Capture
- Upload, each line decision (approve, modify, write-off, revert) with any hours or amount override, billing sign-off, sign-ins, and account changes such as invites and consent are recorded with actor, action, timestamp, and IP address. The free-text note on a decision stays on the decision record so a deletion request can be honored; the audit row records only that a note was present.
- Integrity
- Append-only and enforced in the database: the runtime role can only insert audit rows, and triggers reject any change or removal even if a privilege is later re-granted.
- Retention
- Audit records live in your firm’s environment and are retained per your firm’s document-retention policy.
Least-privilege access
- Default posture
- The application runs in your firm's own cloud and network. Billswarm deploys and updates it with a deploy identity your firm creates and can revoke at any time; CloudTrail in your account records every call made with it.
- Incident access
- Incident response uses that same firm-granted identity, so it appears in the same CloudTrail log. There is no separate support back door.
- Background checks
- Planned for all personnel with deployment access as the team grows.
Subprocessors
- Posture
- The list is short. It lives in the data-processing addendum to your firm's agreement, and we notify your firm of material additions.
- Client-data sub-processors
- The reference deployment goes into your firm's own AWS account, using RDS (Postgres), S3, KMS, and Amazon Bedrock. Inference is called from that same account under your firm's IAM, and the application has no model route outside your own tenant. Under AWS's published Bedrock terms, prompts and outputs are not used to train models and are not shared with the model provider.
Vulnerability reporting
- Channel
- austin.eisenman@billswarm.com. We acknowledge within five business days.
- Safe harbor
- Good-faith testing of billswarm.com is welcome; report what you find to the address above. Customer deployments are each firm's property and are out of scope without that firm's written permission. We will not pursue legal action against researchers who follow those two rules.