Security and governance at Swootle

Built for clear oversight

• Guided customer submissions: Customers move through the questions, declarations and requests your team configures for the flow.
• Structured evidence collection: Collect documents, data and confirmations in a consistent record instead of scattered messages and files.
• Conditional workflow logic: Branch questions and evidence requests according to customer type, service, jurisdiction or risk context.
• Review and approval stages: Route cases for internal review, request more information and record the outcome before approval.
• Submission and decision history: Keep submitted evidence and review context together so teams can understand what was decided and why.
• Configurable templates: Start from a reusable workflow and adapt its questions, evidence requirements, branching and approvals.

Your team stays in control

• Your policies, in practice: Turn your policies and procedures into a guided process for customers, operations teams and reviewers.
• Controls that fit your process: Choose the questions, evidence requirements, review steps and approval stages that fit your customers and your risk approach.
• Clear decision context: Bring submissions, evidence, review steps and decision history into one workflow record, so your team can follow each case with confidence.
• Adapt as you grow: Update your templates as your services, risk approach and internal procedures evolve.

Confidence in your security review

We help your security, compliance and procurement teams get the information they need to evaluate Swootle. Explore our certification and privacy information, or talk to us about your requirements.

Verify the certificate in the IASME register

• Cyber Essentials: VERAXA AI LTD, the company trading as Swootle, holds Cyber Essentials certificate bb709454-557b-4fe4-85b3-bb048bcd2011. Certified 30 September 2026; expires 30 September 2027. Our team can help you review the certificate scope as part of your assessment.
• Privacy information: Our Privacy Policy explains how we use personal data, our retention principles, international transfers and the types of service providers we work with.
• Support for your review: Ask us for the current subprocessor list and discuss your product, data-flow, implementation and security questions with our team.
• Plan your implementation: Discuss hosting, data residency, access, retention and service requirements with us so the agreed solution is clear before you get started.

Read the Privacy Policy for data categories, retention, transfers and subprocessors, and the Terms for information about using Swootle and our service agreement.

Vulnerability disclosure policy

Report a suspected vulnerability privately to [email protected]. This mailbox is assigned to the Swootle security owner and reviewed on UK business days. Please do not send passwords, access tokens, private keys, identity documents or customer data by email.

We aim to acknowledge a new report within five UK business days. If you do not receive an acknowledgement, resend the message with the original subject line and the word “FOLLOW-UP”.

What to include

• The affected Swootle hostname, application, API endpoint or feature.
• A concise description of the issue, its likely impact and the conditions required to reproduce it.
• Reproduction steps and the smallest safe proof of concept; remove credentials, personal data and customer content.
• Any suggested mitigation and whether you intend to publish the finding.

Research rules

• Use only accounts and data you own or are expressly authorised to test.
• Make the minimum requests needed to demonstrate the issue, and stop immediately if you encounter personal data, secrets or another customer’s information.
• Do not retain, copy, alter, delete or publicly disclose data obtained during testing. Tell us what was accessed so we can investigate safely.
• Do not use denial of service, destructive testing, high-volume automated scanning, social engineering, phishing, spam, physical intrusion or attacks against Swootle staff or suppliers.

Scope

This policy covers Swootle-operated web applications, APIs and supporting services on swootle.com and its managed subdomains. Customer-owned domains are in scope only where the reported issue is caused by Swootle’s application or managed configuration. Third-party products and services are outside our authority unless the issue arises from how Swootle integrates or configures them.

How we respond

We will validate and risk-rate the report, identify an owner and provide a status update after initial triage. Remediation and disclosure timing depend on severity, exploitability, affected customers and the availability of a safe fix. We ask reporters to keep findings confidential until remediation is complete or a coordinated disclosure date has been agreed in writing.

Good-faith research

When research follows this policy, Swootle will treat it as authorised for the purpose of investigating and resolving the reported issue and will not initiate legal action solely because of that research. This commitment cannot authorise activity against systems, accounts or data owned by somebody else, and it does not override applicable law.

Swootle does not currently operate a public bug-bounty programme. A report does not create an entitlement to payment, although we may acknowledge helpful reports with the reporter’s permission.

Let's talk about your requirements

Show us the process you want to improve. We will walk through how Swootle could support your team and discuss the security and implementation questions that matter to you.

• Explore the product — Review the workflow builder, customer journey, case record, risk rules and reports.
• Explore enterprise plans — Find out how we scope Swootle around your team, workflows and implementation needs.
• Talk through your workflow — Book a demo to explore your requirements using an anonymised example from your process.