Swiftype Site Search

What Swiftype Site Search Is

Swiftype Site Search is a hosted search product that gives websites and applications fast, relevant search without running their own search infrastructure. It is now part of Elastic, the company behind the Elasticsearch and Elastic Stack ecosystem. You add it by embedding a JavaScript snippet that loads from Swiftype and Elastic domains and calls a hosted search API. Because the snippet runs in the visitor browser and the index lives on Swiftype servers, search queries and related data are sent to the provider. This convenience comes with a larger privacy footprint than a self hosted engine, since a third party processes the queries and can set cookies. Understanding what it stores and where is essential before deploying it on an EU facing site.

Cookies and Data Collected

The Swiftype embed can set first party cookies and use localStorage to store a search session identifier and remember preferences, and an analytics enabled configuration may add further first party cookies. It collects the search queries that visitors type, the results they click, and technical metadata such as IP address and browser information used to operate and improve the search. This query and click data is processed as analytics to measure search performance, which goes beyond what is strictly necessary to return results. Because the data is sent to Swiftype servers, the provider acts as a processor for the personal data contained in queries and logs. You should treat the search session cookies and analytics as requiring consent rather than as strictly necessary. Always confirm the current cookie behaviour in your own deployment, as it can change with configuration.

GDPR and ePrivacy Implications

Under the ePrivacy Directive, the cookies and storage Swiftype uses for session tracking and analytics are not strictly necessary, so prior consent is required before the embed sets them. Under the GDPR you act as the data controller for the search queries and visitor data, and Swiftype operated by Elastic acts as your processor, which means you need a data processing agreement in place. The search analytics functionality relies on consent, while purely returning results that a visitor explicitly requested might be argued under legitimate interest, but the cookie consent obligation still applies. Because all data is stored in the United States, an international transfer assessment is also required. The combination of non essential cookies, analytics, and US storage makes Swiftype a higher risk choice for EU websites. Clear documentation and a robust consent flow are essential.

Consent Requirements and CMP Integration

Treat the Swiftype embed as a non essential third party that must be blocked until the visitor gives consent. Integrate it with your consent management platform so the script only loads after the user accepts the relevant cookie category, typically functional or analytics. Avoid firing the embed on page load before consent is captured, and provide a clear way to withdraw consent that stops further loading. Your consent banner should name Swiftype or Elastic, explain that search queries are processed in the United States, and link to your privacy notice. Test that declining consent genuinely prevents the cookies and the network calls. Keep a record of consent so you can demonstrate compliance if challenged.

International Data Transfers

Swiftype stores all customer data in the United States, using Texas data centers as the primary platform with offsite backups in Amazon AWS infrastructure in the US, and it does not host data within the European Union. For an EU website this means visitor search queries are transferred to a third country, which the GDPR only permits with an appropriate safeguard. You should rely on the EU US Data Privacy Framework where the provider is certified, or on Standard Contractual Clauses, and complete a transfer impact assessment that considers US surveillance laws. Document the safeguard in your records of processing and your privacy notice. If you cannot accept a US transfer, an EU hosted or self hosted search engine is a better fit. Review the transfer mechanism periodically as the legal landscape evolves.

Practical Compliance Steps

Start by signing the Swiftype data processing addendum with Elastic and confirming the transfer safeguard you will rely on for US storage. Configure your consent management platform to block the embed until consent is given for the relevant cookie category. Update your privacy notice and cookie policy to name Swiftype, describe the session and analytics cookies, and disclose the US transfer. Set sensible retention for search analytics and limit who can access the Swiftype dashboard. Complete a transfer impact assessment and, where the risk is significant, a Data Protection Impact Assessment. Test the consent flow to ensure declining truly stops the cookies and the calls. Finally, schedule periodic reviews so your documentation stays aligned with the live configuration.