// Trust & Security Report
Swagger/OpenAPI
by SmartBear Software Inc.
Swagger is SmartBear's API design/documentation brand: (1) free open-source tools (Swagger Editor, Swagger UI, Swagger Codegen) that run client-side/self-hosted with no vendor-side data processing, and (2) the commercial "Swagger" team/enterprise offering, which is SmartBear's SwaggerHub SaaS product for API design governance, collaboration, and hosting of API specs.
Certifications held
5
Maturity
Enterprise
Trains on your data
Unknown
Trust center
Yes
// Certification ledger
Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.
Verify on trust.smartbear.com“Documents Get access REPORTS Network Diagram REPORTS Pentest Reports REPORTS SOC 2 Type 2 Report REPORTS SOC 3 Report COMPLIANCE ISO/IEC 27001 COMPLIANCE SOC 2 SELF-ASSESSMENTS CAIQ PRODUCT SECURITY”
Verify on trust.smartbear.com“RTS Pentest Reports REPORTS SOC 2 Type 2 Report REPORTS SOC 3 Report COMPLIANCE ISO/IEC 27001 COMPLIANCE SOC 2 SELF-ASSESSMENTS CAIQ PRODUCT SECURITY Product Architecture DATA SECURITY Privacy & Security FAQ APP S”
Verify on trust.smartbear.com“and request access to our security documentation. Compliance CCPA EU-US DPF GDPR ISO/IEC 27001 SOC 2 DORA EU AI Act SmartBear is reviewed and trusted by National Geographic Adobe Google JetBlue”
Verify on trust.smartbear.com“CCPA is listed as a compliance badge on SmartBear's Trust Center, and the privacy policy documents California resident rights consistent with the CCPA.”
Verify on trust.smartbear.com“RTS Network Diagram REPORTS Pentest Reports REPORTS SOC 2 Type 2 Report REPORTS SOC 3 Report COMPLIANCE ISO/IEC 27001 COMPLIANCE SOC 2 SELF-ASSESSMENTS CAIQ PRODUCT SECURITY Product Architecture DATA SECUR”
> Show 6 unconfirmed / not-held certifications
source: trust.smartbear.comNo public evidence of a HIPAA attestation, BAA offering, or HIPAA compliance claim on SmartBear's trust center, security page, or privacy policy.
source: trust.smartbear.comNo public evidence of PCI DSS certification on SmartBear's trust center or security page; Swagger/SwaggerHub does not process payment card data as part of its core product.
source: trust.smartbear.comNo public evidence of FedRAMP authorization on SmartBear's trust center or security page (note: some third-party aggregator listings claim FedRAMP for SmartBear, but this was not corroborated on any smartbear.com or swagger.io domain page).
source: trust.smartbear.comNo public evidence of a CSA STAR registry entry or self-assessment on SmartBear's trust center or security page (third-party sources mention "CSA Star Level 1" but this could not be verified on a vendor-owned page).
source: smartbear.comNo public evidence of ISO/IEC 42001 or any AI-governance-specific certification on SmartBear's trust center or security page.
source: trust.smartbear.comNo public evidence of ISO 27017, 27018, or 27701 certification on SmartBear's trust center; only ISO/IEC 27001 is listed.
// Privacy & AI training
Trains on customer data
Not stated
Data processing agreement
Offered
Data region
"We process and store personal information both inside the United States and overseas." Transfers outside the EEA/UK use GDPR-compliant safeguards including Standard Contractual Clauses. No dedicated EU-only or region-locked hosting option was found for Swagger/SwaggerHub specifically.
Neither the SmartBear privacy policy nor the security page states whether customer API specs or SwaggerHub content are used to train AI models. The security page references only "restrictions on sharing confidential or customer data with AI systems" (an internal-use control), not a customer-facing AI-training commitment.
// Security controls
Encryption in transit and at rest
Data encryption for data in transit and at rest cited as a standing security practice
smartbear.comAdministrative access control
Multi-factor authentication required for administrative access
smartbear.comMonitoring & incident response
Centralized logging and monitoring, with a formal incident response program
smartbear.comHosting infrastructure
Runs on Amazon Web Services (AWS EKS & EC2) per SmartBear's trust center infrastructure disclosure
trust.smartbear.comSOC 2 audit scope
2025 SOC 2 Type 2 report covers SwaggerHub, Portal, Explore, Pactflow, Zephyr Enterprise/Scale/Essentials, and Platform Services (Trust Services Criteria: Security)
trust.smartbear.com// Products & data scope
Data it handles: Runs in the browser or self-hosted; no customer API-spec data is sent to or processed by SmartBear as a SaaS backend for these tools
Free and community-maintained; not named in the scope of SmartBear's SOC 2 Type 2 report, since there is no vendor-hosted data flow for these tools by default. Self-hostable.
Data it handles: Hosts customer API specifications (OpenAPI/AsyncAPI/JSON Schema), team collaboration data, org/role metadata, and integration credentials for connected API gateways/version control
This is the product explicitly named "SwaggerHub" in SmartBear's SOC 2 Type 2 scope statement. It is SaaS-hosted, not self-hostable in the standard commercial tiers found.
// What to watch
- SmartBear's SOC 2 Type 2 report names the commercial product "SwaggerHub" specifically, not the free, open-source Swagger Editor, UI, or Codegen tools. SOC 2 and ISO 27001 apply to the SwaggerHub commercial tier, not the free open-source tools.
- ISO/IEC 27001 is listed as a named compliance document category on SmartBear's Trust Center (SafeBase-hosted), but the underlying certificate/scope statement is gated behind an access request and was not independently viewable, so the exact certification scope and issuing body could not be fully confirmed beyond the badge listing.
- Third-party aggregator pages (not vendor-owned) claim SmartBear also holds FedRAMP and CSA STAR Level 1, but these were not found on any smartbear.com or swagger.io page.
- No vendor statement was found confirming or denying AI-model training on customer or API-spec data for Swagger/SwaggerHub's AI features.
// At a glance
Pricing model
Freemium: open-source tools are free; SwaggerHub / "Swagger" team and enterprise tiers are subscription-based (per-seat/org pricing, contact sales for enterprise)
Self-hostable
Yes
// How we verified this
Every certification marked HELD is confirmed against a verbatim quote on SmartBear Software Inc.'s own trust, security, or privacy pages. We reject certifications claimed only on third-party aggregators, on a cloud host's behalf, or by a similarly named company.
Last verified 2026-07-09. Compliance changes over time. Always confirm directly with the vendor before relying on any certification for a purchasing or compliance decision.
trust.smartbear.com// Trust reports for comparable tools
Other tools in the same category, each with its own sourced report.