Security

Last updated 27 July 2026

Handing your vendor files to a young company is a real decision, and you should be able to check the work before you make it. This page is the long answer: where your data sits, who can reach it, what the application does to protect it, how you get everything back out, and — the part most vendors leave off — what we have not built yet.

Where your data lives

• United States, both halves. Certificate files are held in Amazon S3 in a US region; the application database and job queue run on Railway in a US region. We do not replicate customer data outside the United States.
• The file store is private, versioned and encrypted. The bucket blocks all public access, server-side encryption is on by default (AES-256), and versioning is enabled — an accidental overwrite or delete is recoverable rather than final.
• Traffic is encrypted in transit (HTTPS everywhere, including between the application and every provider listed below).
• Backups run nightly, are restore-tested as part of the job rather than assumed to work, and expire automatically after 30 days.

Who can reach it

Parapet is built and run by one person, its founder, working from the Philippines. Your data stays in the United States; the administration of it happens from there. We would rather write that down than have you discover it in a billing record. On a call you will always be talking to the person who wrote the code — there is no one else to be passed to.

• Exactly one person holds production access, and every provider account behind it — AWS, Railway, Vercel, Cloudflare, Anthropic — is protected by two-factor authentication.
• There is no "sign in as customer" feature. This is worth being precise about, because most tools have one. Parapet's internal admin surface covers signup approvals and nothing else — it cannot open your vendors, your certificates or your reports. Reaching your records means going to the database deliberately, which happens for a support request you have made or an incident we are fixing, and not otherwise.
• No subcontractors, no offshore support team, no data brokers. The providers in the table below are the complete list of third parties that touch your data.

What the application enforces

The audit log

Every state change writes an entry: who did it, what they did, to which record, when, and from what IP address. That log is one of the things you are buying — it is what you hand an insurer or an auditor who asks how you knew a vendor was covered on a given date.

It is append-only at the database level, not by convention. The database account the application runs as has had UPDATE and DELETE revoked on the audit table. A bug in our code cannot rewrite history, and neither can we without changing database roles — which is itself a deliberate, logged act. There is an automated test that fails the build if that revocation is ever lost.

Who else processes your data

These providers act on our instructions and may not use your data for their own purposes. The full detail, including what each one receives, is in the privacy policy.

Getting your data out — and what happens if we disappear

You should ask a two-person company this question, so here is the answer in writing.

• Parapet is not the only copy. It mirrors documents you already hold and already receive by email. If we vanished tomorrow you would be back where you started, not somewhere worse. That is deliberate, and it is why the product never asks you to delete anything on your side.
• Export whenever you like. Owners and admins can download a CSV of the entire vendor and compliance dataset — every vendor, every certificate, its extracted fields, its status and its expiry dates — from inside the app, without asking us.
• The original PDFs are yours on request, as a single archive, and we will turn that around within five business days. It is a manual step today rather than a button; we would rather say so than imply a feature we have not shipped.
• If Parapet ever shuts down, you get at least 90 days' notice, a full export of your data and files, and the service stays running through that window. This is a commitment we will put into a signed agreement — ask for it.
• No hostage-taking. Cancelling does not lock your export. There is no fee to get your own data back, at any time, for any reason.

What we do not do yet

We are early, and the useful thing is to tell you where the edges are so you can decide whether they matter to you. If any of these is a blocker for your procurement process, raise it before you buy rather than after.

• No SOC 2 report. An audit at our size would cost more than it would tell you, and we would rather spend it on the product. We will start one when a customer's procurement process genuinely requires it — tell us if that is you, because it changes the maths.
• No two-factor authentication on Parapet accounts yet. It protects our own provider accounts today but is not yet available on yours. It is the next security item we intend to ship.
• No malware scanning of uploaded files. Files are stored, not executed, and served back only through short-lived links to entitled users — but we do not scan them, and you should know that.
• No third-party penetration test. The application has not been tested by an outside firm.
• No formal uptime SLA. We monitor availability and we will tell you when something breaks, but we do not yet offer contractual uptime credits.

Reporting a vulnerability

If you have found a security problem, email security@parapethq.com. You will get a human reply within two business days and an assessment within five. We will not threaten legal action against anyone who reports a problem in good faith, and we are happy to credit you once it is fixed.

Questions

Security questions: security@parapethq.com. Privacy and data-subject requests: privacy@parapethq.com. Everything else: hello@parapethq.com. All three reach a person.