Security
What this site stores, how the platform treats commands and custody records, and how to reach us about a vulnerability. Plain language, no theater.
No accounts. The waitlist is the only PII, and it is documented
swarmonic.ai has no login, no user accounts, and no stored credentials. The public demo does not require an account. The waitlist collects email, name, organization, role, and whether you own robots — that is PII, and it is documented on /privacy. Operator tokens for eval seats are bound to the Vermarco receipt, not to a Swarmonic password database we do not have. No page on this site commands physical hardware. Public API endpoints are read-only portfolio and demo metadata; interactive API explorers are disabled in production.
Encryption in transit
All traffic to swarmonic.ai is served over TLS. Service workers cache only static assets; no telemetry or analytics beacons run on this site.
Response headers you can verify with one request
Strict-Transport-Security— HSTS, two years, subdomains included.Content-Security-Policy— self-origin script/style/connect policy.X-Frame-Options: DENY— no framing.Referrer-Policy: strict-origin-when-cross-originX-Content-Type-Options: nosniffPermissions-Policy— camera, microphone, and geolocation disabled.
Signed, attributable, tamper-evident
The orchestration platform is designed so that every command is attributable: signed command authorizations, named refusals, override and suppression records, and hash-linked custody logs. Emergency stop is never gated by any consent flow, permission tier, or platform state. These properties are enforced by automated tests on every release.
Report a vulnerability
If you find a security issue on this site or in the platform, email hello@swarmonic.ai with steps to reproduce. We acknowledge good-faith reports, we do not pursue researchers acting in good faith, and we credit fixes on request. Please do not test against systems you do not own.
Deployments are governed by signed agreements
Production deployments run under signed agreements with their own security schedules, which supersede this page where they conflict. This page describes the public site and the platform's design posture. Last updated August 15, 2026.