Security Policy

Table of Contents

Purpose and Scope

This document describes the security controls Swift-E Recording Services LLC applies to the Swift-E electronic recording platform. It is intended for clients and prospective clients conducting vendor security review, particularly title agents, lenders, and law firms with their own regulatory obligations.

It covers the Swift-E platform and the infrastructure that supports it. It does not cover County Clerk systems, which are operated by government agencies outside our control, or client-side environments. This document is informational and does not modify the Swift-E Terms of Service, Privacy Policy, or Refund Policy.

Platform and Hosting

The platform is a Laravel 11 / PHP 8.2 application hosted on Microsoft Azure App Service, with data in Azure SQL/managed database services and documents in Azure Blob Storage.
Microsoft Azure maintains an extensive independent certification portfolio, including SOC 1, SOC 2, SOC 3, ISO/IEC 27001, and PCI DSS, covering the physical and infrastructure layers beneath our application.
Production and staging run as separate environments with separate storage.
All outbound traffic egresses through a dedicated NAT Gateway providing a stable, single outbound IP address. This supports IP allowlisting required by County recording systems.

Encryption

In transit: all traffic is served over TLS. The application forces the HTTPS scheme at the framework level, so generated URLs and redirects remain encrypted.
At rest: data and documents are encrypted at rest by Azure Storage and Azure database services using platform-managed keys.
Application-level: the application uses AES-256-CBC for framework-level encryption operations.
County transmissions are made over encrypted channels meeting each County's stated requirements, including the 128-bit minimum specified in our executed Palm Beach County eRecording Business Rules agreement.

Customer Authentication and Account Security

Passwords are stored only as salted cryptographic hashes using the framework's bcrypt implementation. Plaintext passwords are never stored, logged, or retrievable, and are excluded from all model serialization.
Two-factor authentication is available on client accounts and can be enabled by the account holder.
New registrations are verified by a one-time code sent to the registered email address before the account is created.
Session cookies are HTTP-only and same-site restricted, sessions are stored server-side in the database rather than in the cookie, and sessions expire after a period of inactivity.
Rate limiting is enforced on four sensitive endpoints: login, signup, two-factor verification, and password reset, to resist credential stuffing and brute-force attempts.
Accounts can be administratively deactivated, with the reason, timestamp, and acting administrator recorded.
Minimum password length is eight characters. [See Part B — strengthening this is recommended before publication.]

Internal Access Control

The platform enforces role separation between client and administrative users at the middleware layer.
Administrative capability is further divided by granular permissions, applied per route, covering request management, client management, transaction management, reporting, and financial reporting. An administrator holds only the permissions assigned to them.
Client accounts can access only their own submissions, documents, and financial records.
Access to production infrastructure is limited to personnel who require it, under scoped and revocable permissions. Contractor access is scoped separately from infrastructure controls, and account ownership of hosting, DNS, cloud, and source control is retained by Swift-E in all cases.

Secrets Management

Integration credentials, API keys, and connection strings are held in Azure Key Vault and retrieved by managed identity, rather than stored in application configuration or source control.
Secrets are stored granularly — one secret per integration and per County — rather than as a single consolidated configuration blob, to contain blast radius and allow independent rotation.
[CONFIRM: state whether Key Vault migration is complete in production as well as staging, and state your rotation cadence.]

Payment Security

Payment processing is handled by Stripe, Inc., a PCI DSS Level 1 certified service provider.
Swift-E does not store, process, or transmit full payment card numbers, card security codes, or bank account numbers. Card and bank details are collected by Stripe directly.
The platform stores only Stripe reference identifiers — a customer identifier and per-transaction identifiers — which cannot be used to initiate a charge outside our authenticated integration.
[CONFIRM your PCI DSS self-assessment level with Stripe; a fully hosted or Stripe-Elements integration is typically SAQ A. State it explicitly, as vendor questionnaires ask for it.]

Document Handling and Subprocessors

Documents submitted for recording are stored in Azure Blob Storage and transmitted to the destination County in the format that County requires. Where a client uses the optional automated extraction feature, document content is processed by Microsoft AI services operating within Swift-E’s own Azure tenant.

Document content is not sent to any public or consumer AI service, and is not used to train any model.

Subprocessor	Purpose	Data Received
Microsoft Azure	Hosting, database, blob storage, secrets management	All platform data
Azure AI Document Intelligence	Optical character recognition for optional extraction	Document images
Azure OpenAI Service (Swift-E tenant)	Structured field extraction for client review	Document text
Stripe, Inc.	Payment processing	Payment credentials, transaction data
Email delivery provider [INSERT]	Transactional email	Email address, message content

Extraction output is presented to the client for review and correction. No extracted value is transmitted to a County without human review.

Application Security and Change Management

The platform is built on a currently supported major release of the Laravel framework, which provides built-in protection against SQL injection through parameterized queries, cross-site request forgery through per-session tokens, and cross-site scripting through automatic output escaping.
Source code is held in a private repository with branch protection rules enforced on the primary branch.
Automated static analysis is run against the codebase for security findings. [CONFIRM CodeQL is enabled and passing on the production branch.]
Changes are developed and tested in a separate staging environment before promotion to production.
Contractor-delivered code is reviewed before acceptance. [CONFIRM you want to state this externally — it is accurate, and it is a genuine differentiator.]

Logging and Monitoring

Application and platform logs are retained through Azure App Service diagnostics.
Cloud control-plane activity is monitored through the Azure Activity Log, with alerting configured on sensitive operations such as retrieval of publishing credentials.
Administrative actions affecting client accounts, rates, and financial records are recorded in application audit logs, including an immutable log of every change to a client's negotiated rate.
Submission activity is recorded per document, including status transitions and County responses.

Data Retention and Deletion

Data retention policies are currently under active development. Automated retention, deletion, pruning, and expiry processes for submitted documents, derived image files, extracted index data, session records, and logs have not yet been implemented or verified. Retention periods will be published once the retention system is fully implemented and validated.

Backup and Business Continuity

Backup and disaster recovery procedures are currently under review and implementation. Database backup method, backup frequency, retention period, geo-redundancy, blob storage replication, restore testing, Recovery Point Objective (RPO), and Recovery Time Objective (RTO) have not yet been finalized or verified. These details will be documented once the backup and business continuity processes have been fully configured and tested.

Incident Response and Breach Notification

Swift-E maintains an incident response process covering detection, containment, investigation, remediation, and notification. [CONFIRM — if no written plan exists, write a short one before making this statement. A two-page plan naming who does what is sufficient and is far better than an unsupported claim.]

If we determine that unauthorized access to unencrypted personal information has occurred, we notify affected individuals and, where required, the Florida Department of Legal Affairs, in accordance with Section 501.171, Florida Statutes — as expeditiously as practicable and no later than 30 days after determination.
Where an incident affects information we process on behalf of a client, we notify that client so they can meet their own notification obligations, including any obligation under the Gramm-Leach-Bliley Safeguards Rule.
We cooperate with client investigations and provide records reasonably necessary to establish scope.

Personnel and Contractors

Access to client data is limited to personnel and contractors with a business need.
Contractors work under written agreements addressing confidentiality and intellectual property, and receive scoped, revocable access rather than administrative ownership. Swift-E retains ownership of all hosting, DNS, cloud, source control, and payment accounts.
Access is reviewed and revoked on role change or engagement end.

Compliance Posture

We state our position plainly rather than implying certifications we do not hold.

Swift-E does not currently hold a SOC 2 or ISO/IEC 27001 certification. Our hosting provider, Microsoft Azure, holds SOC 1, SOC 2, SOC 3, ISO/IEC 27001, and PCI DSS certifications covering the infrastructure layer.
Swift-E is an approved electronic recording submitter with participating Florida County Clerks, including Palm Beach County and Hillsborough County, and operates under executed business rules agreements with those Counties that impose security and technical requirements we are audited against by the Counties.
Submissions conform to PRIA standards and to each County's technical specification.
We support client compliance obligations under the Gramm-Leach-Bliley Safeguards Rule as a service provider, and will execute a reasonable written service provider or confidentiality agreement on request
[CONFIRM whether an independent penetration test has been performed. If not, consider commissioning one — it is the single most persuasive artifact in a vendor review short of SOC 2, and is achievable at modest cost.]

Shared Responsibility

Security depends on both parties. Clients are responsible for:

Safeguarding account credentials, enabling two-factor authentication, and not sharing logins.
Managing their own authorized users and promptly notifying us of departures or suspected compromise.
Verifying the accuracy and authority of every document submitted, and reviewing extracted field values before authorizing submission.
Understanding that a recorded document becomes a public record under Chapter 119, Florida Statutes, and that no security control can restrict access to it once recorded.

Reporting a Vulnerability

If you believe you have found a security vulnerability in the Swift-E platform, report it to security@swifterecordingservices. Please include enough detail to reproduce the issue. We ask that you allow us a reasonable period to remediate before public disclosure, and that you do not access, modify, or delete data belonging to others, or degrade the service, while investigating. We will acknowledge reports promptly and will not pursue action against good-faith researchers who follow these guidelines.

Requesting Further Documentation

Clients and prospective clients conducting vendor review may request a completed security questionnaire, a written service provider or confidentiality agreement, or additional detail about a specific control. Contact customersupport@swifterecordingservices.com . Detailed architectural and configuration information is provided under a mutual non-disclosure agreement.

Sign up for free. No annual fees. No subscriptions. No minimums. Pay only when you record.