Security and integrations
What Swype does with your company's money, and what it doesn't yet.
- Swype never charges a card
- Your admin buys with the merchant. Swype records it.
- No card numbers stored
- The card product and last 4 digits only.
- Rules decide, not the AI
- A policy engine makes every call. Alfi reports it.
What's live
| What | Status | Notes |
|---|---|---|
| Reward estimates for 33 US cards (15 business) | Live | Card rules from published issuer terms, with sources and dates. Not a connection to your card accounts |
| Paying with your own card | In progress | Single-use virtual cards issued on your card through issuer programs; preparing applications |
| Restaurants and delivery | Pilot sandbox | Needs ordering partners; major delivery apps don't offer third-party ordering APIs today |
| Rides | Planned | Shown in the demo as a prototype |
| Cash fares and hotel rates | Live | Google Flights and Google Hotels via SerpAPI, for signed-in searches; sample data when signed out |
| Award availability | Not yet | Live searches show no award prices yet. The seats.aero flight integration is built and stays off until its API key and written commercial agreement are in place; signed out, Travel shows labelled samples |
| Point transfers and booking | Not yet | Swype links to each bank's transfer page and the airline or hotel's own site; it doesn't move points or book |
| CSV export of every order | Live | From the finance dashboard |
| QuickBooks, Xero, NetSuite | Planned | — |
| Google sign-in | Live | — |
| SAML single sign-on | Not yet | — |
Not yet
- No SOC 2 report yet.
- No PCI DSS assessment yet. Swype doesn't handle card numbers today; real payments will require one before launch.
- No single sign-on (SAML) or Swype-enforced two-factor yet. Sign-in relies on your Google account's own protections.
Payments
During the pilot, restaurants and payments are simulated: no charge reaches any card. Orders, policy checks, approvals, receipts and the finance ledger all run for real.
For real payments, Swype is preparing to apply to card issuers' virtual-card programs, which issue a single-use card number on your company's own card for each approved order. The charge stays between your card and the merchant: Swype doesn't become the merchant, so the purchase keeps the merchant's category and your card's rewards terms apply.
Controls
- Rules run on the server
- A deterministic policy engine decides every order before payment. The AI assistant reports decisions; it can't make or override them.
- Checked again at payment
- Prices and policy are rechecked right before paying; if anything changed, the employee sees the new total first.
- Roles and approvals
- Admins, Approvers and Employees. Approvers can't approve their own requests, and an approval covers one total, nothing above it.
- A trail for every order
- Request, policy decision and version, approval, confirmation, payment, receipt and reward state, exportable as CSV.
- Versioned policies
- Every change records who made it, when, and what changed.
- One payment per order
- Each order carries its own payment key, so retries and double taps can't charge twice.
Data
Stored in Google Cloud Firestore, which encrypts data at rest by default. The app is hosted on Vercel.
- Company cards
- The card product and last 4 digits. Never a full card number, expiry or CVV.
- People
- Names, work emails, roles and teams, from Google sign-in and admin invites.
- Orders
- Items, totals, policy decisions, approvals, receipts and reward estimates.
Questions about security for your company? Ask through the pilot form