Swap provides returns, exchange, cross-border and agentic commerce infrastructure to global brands. This Trust Center sets out our certifications, the controls in our security programme, the subprocessors that handle customer data, and how to obtain our audit reports.
Where a certification is limited in scope, we say so. Certificate numbers and issuing bodies are published in full so you can verify them independently.
Each certificate below is issued by an accredited third party.
ISO/IEC 27001:2022
Certified
Standard
ISO/IEC 27001:2022 — Information Security Management Systems
Certificate no.
1126944
Issuing body
The Standards Institution of Israel (SII), with IQNet equivalent certificate issued alongside
Valid
17 February 2026 — 17 February 2029
Statement of Applicability
Version dated 12 January 2026
Certified sites
London · Amsterdam · Jerusalem · New York
Scope
The Information Security Management System supporting Swap's IT Operations function across the four certified sites.
We publish our certified scope rather than implying company-wide coverage. Request a copy of the certificate from your account team or security@swap-commerce.com — no NDA needed — and we are glad to walk through how the scope maps to the services you use.
SOC 2 (SSAE 18)
Reports under NDA
Report
SOC 2 Type 2
Auditor
Prescient Assurance
Criteria
Security, Availability, Confidentiality
Availability
Released to customers and prospects under a mutual NDA
Our SOC 2 reporting is maintained on an annual cycle with Prescient Assurance. To request the current report, speak to your Swap account team or email security@swap-commerce.com.
Trusted by
Swap handles returns, exchanges and cross-border commerce for brands and retailers worldwide.
Controls
Swap operates 76 controls, monitored continuously and evidenced against ISO 27001:2022 and the SOC 2 Trust Services Criteria. The public view shows the five control families; the individual control statements and their current operating status are available under NDA on request.
21
Infrastructure security
Access to production systems, networks and datastores.
35
Internal security procedures
Governance, change management, incident response and risk.
12
Organisational security
People, devices and company assets.
5
Product security
How the platform itself is protected and tested.
3
Data and privacy
Classification, retention and deletion.
Subprocessors
The five entries below are a preview of the complete Legal-signed list. The canonical subprocessor page contains all 44 entries with registered addresses and processing descriptions, so there is one source to maintain.
Selected subprocessors
Subprocessor
Processing
Registered in
ACCESS UK LIMITED ("Mintsoft")The Old School, Stratford St Mary, Colchester, England CO7 6LZ
Enabling access to supported carriers through API.
United Kingdom
Adyen N.V.Simon Carmiggeltstraat 6-50, 1011 DJ, Amsterdam, the Netherlands
Storefront transaction acquiring.
Netherlands
Anthropic Ireland, Limited6th Floor South Bank House, Barrow Street, Dublin 4, Ireland
AI assistant with connected access to internal systems containing merchant and customer data (Slack, Drive, email, compliance and HR platforms).
Ireland
Anysphere, Inc. (Cursor)2261 Market Street STE 86466, San Francisco, CA 94114, United States
AI development environment with repository access.
United States
Avalara, Inc.255 S. King St., Ste. 1200, Seattle, WA 98104, United States
All of our documentation is available on request. Speak to your Swap account team, or email security@swap-commerce.com with the documents you need and who will hold them. Certificates are released without an NDA. Auditor reports, compliance artefacts and the internal documents behind them are released under a mutual NDA.
Ask your Swap account team, or email security@swap-commerce.com. Tell us which documents you need and who will hold them.
02
Execute a mutual NDA if you have asked for an auditor report or a compliance artefact. If one is already in place between our organisations, we will use it. Certificates and our legal terms need no NDA.
03
Documents are released to the named recipients. Requests are reviewed by our security team, and we aim to respond within three business days.
Updates
SOC 2 Type 2 observation window closed
Fieldwork with Prescient Assurance is complete. The report is available to customers and prospects under NDA on request.
ISO/IEC 27001:2022 certification achieved
Certificate 1126944 issued by The Standards Institution of Israel, valid to February 2029, covering four sites.
Frequently asked security questions
Is Swap ISO 27001 certified?
Yes. Swap holds ISO/IEC 27001:2022 certificate 1126944, issued by The Standards Institution of Israel and valid to 17 February 2029. The certified scope covers the Information Security Management System supporting our IT Operations function across London, Amsterdam, Jerusalem and New York. We publish the scope rather than implying company-wide coverage, and a copy of the certificate is available on request without an NDA.
Does Swap have a SOC 2 report?
Yes. Swap's SOC 2 Type 2 reporting is conducted by Prescient Assurance against the Security, Availability and Confidentiality Trust Services Criteria, and is maintained on an annual cycle. Reports are released to customers and prospects under a mutual NDA — speak to your Swap account team or email security@swap-commerce.com.
What controls does Swap operate?
Swap operates 76 controls across five families. The family-level counts are shown in the Controls section above. They are monitored continuously and evidenced against ISO 27001:2022 and the SOC 2 Trust Services Criteria. The full control list with current operating status is available under NDA on request.
Who are Swap's subprocessors?
Swap discloses all 44 of its subprocessors publicly, each with its full registered name, registered address and a description of the processing it performs. The canonical list is published at /sub-processor-list and forms part of our Data Protection Addendum. We notify customers of changes in line with that agreement.
Where is our data stored?
Swap runs on Google Cloud Platform. Data residency for your deployment is set out in your order form and Data Protection Addendum. Speak to your account contact if you have a specific residency requirement.
How do I get your security and compliance documentation?
Everything is available on request. Speak to your Swap account team, or email security@swap-commerce.com, and tell us which documents you need and who will hold them. Our certificates and legal terms — the ISO 27001:2022 certificate, the IQNet equivalent and our Data Protection Addendum — are released without an NDA. Auditor reports and compliance artefacts, including the SOC 2 report, our penetration test summary, our Statement of Applicability and completed security questionnaires, are released under a mutual NDA to named recipients. Our full subprocessor list is published at /sub-processor-list, with no request needed.
How do I report a security vulnerability?
Email our security team. We will acknowledge your report and keep you updated as we investigate. Please give us reasonable time to resolve an issue before disclosing it publicly. Our machine-readable contact details are published at /.well-known/security.txt.
Contact
Security enquiries
Questionnaires, audit reports and architecture reviews.
