Swirl.SWIRL CLOUD
Your data stays where you put it. Every outside service is listed.
Swirl Cloud runs on the servers and at the host you choose, and so under the jurisdiction you choose. The platform documents every outside service it contacts and what each receives, switches vendor telemetry off and is built mainly on open-source components you can operate yourself.
What stays with you
Your servers
Rented from the host and in the country you choose, installed on your premises, or operated by Swirl on servers hosted in the EU. Applications, databases and local backups stay there.
Your keys
Vault keeps the secrets on your installation, and your administrators export the recovery kit. Administrator rights are time-limited and recorded.
Your backups
The nightly archive stays on your servers; the off-site copy, if you choose one, is encrypted before it is sent to the S3 storage you pick.
No usage telemetry
Usage reports and version checks in GitLab, Grafana, Kibana, SonarQube, Portainer, Longhorn, Traefik and Odoo are switched off.
Every outside service
The services the platform contacts while installing and running, and what each one receives.
- Default
Cloudflare
- Provider
- Cloudflare, Inc. (United States)
- Used for
- Public DNS, edge TLS, DDoS protection, sign-in gate for administration tools
- Receives
- The DNS zone, all public web traffic (decrypted at the edge) and administration sign-in identities
Protects public addresses; a private installation does without it.
- Optional
Tailscale
- Provider
- Tailscale Inc. (Canada)
- Used for
- Private network between servers, if you choose it
- Receives
- Server public keys, names and addresses; traffic stays end-to-end encrypted
Alternatives: OVHcloud vRack or your local network.
- Optional
GitHub
- Provider
- GitHub, Inc., Microsoft (United States)
- Used for
- Repository import and mirroring, if you choose it
- Receives
- Content and history of mirrored repositories
Repositories can stay in your GitLab only.
- Optional
OVHcloud API
- Provider
- OVH SAS (France)
- Used for
- Automatic vRack attachment of new servers
- Receives
- Server and vRack names
Servers can be attached by hand.
- Optional
S3 backup storage
- Provider
- Chosen by you
- Used for
- Off-site copy of recovery archives and volumes
- Receives
- Archives encrypted before upload
Or another machine you control.
- Default
CrowdSec
- Provider
- CrowdSec SAS (France)
- Used for
- Community block list on internet-exposed servers
- Receives
- Addresses that attacked the server and the matching scenarios
Active by default, in exchange for the block list.
Images and packages come from public registries (Docker Hub, Quay, GitHub, Elastic, Kubernetes, Ubuntu, CrowdSec), which only see the downloading address and what is downloaded. Every image is pinned by its digest.
Free to leave
Your code is in Git, your images in an OCI registry, your databases dump to standard PostgreSQL and MongoDB formats, and your deployments are Kubernetes manifests in Git. None of it depends on a Swirl-specific format.
On the roadmap
- A strict sovereignty mode that refuses any non-EU or non-self-hosted dependency and reports every remaining external call.
- A self-hosted private network (Headscale, NetBird or WireGuard) in place of Tailscale.
- Offline installation from a signed bundle, with no downloads from public registries.
- A documented exit procedure to run the platform without Swirl.
Frequently asked questions
Does any data leave our servers?
Only to the services listed on this page, for the purpose shown. Application data, secrets and backups stay on your installation, except the off-site copy you choose, which is encrypted before upload.
Where are the servers when Swirl runs the platform?
On servers hosted in the EU. You can also run Swirl Cloud on servers of your choice, rented or on your premises.