Data Protections

• Data encryption at rest (AES-256)
• Encryption in transit (TLS 1.2+)
• LLM no training policy by default
• LLM Zero Data Retention
• Audit logging
• Automatic PII redaction in logs

Authentication & Access

• Single Sign-On (SSO)
• Multi-Factor Authentication (MFA)
• Role-Based Access Control (RBAC)
• API key management
• JWT-based authentication

Compliance & Governance

• CSA STAR Level 1
• Trusted Site
• GDPR/CCPA Compliant
• SOC 2 Type I — report issued June 19, 2026 by Johanson Group LLP
• Cyber Insurance

Working Towards

• SOC 2 Type II — observation period underway
• ISO 27001 — expected completion: Q4 2026
• HIPAA — expected completion: Q4 2026

01

How your data is stored and handled

Data is encrypted at rest with AES-256 and in transit with TLS 1.2 or higher. Logs are scrubbed of personally identifiable information automatically rather than by manual review, so support and debugging work does not require reading customer data.

02

How we treat data sent to AI models

This is the question we are asked most, so to be explicit: your data is not used to train AI models. We operate a no-training policy by default across our model providers, and use zero-data-retention configurations where the provider supports it, meaning prompts and completions are not retained after the request completes.

Because we route across multiple providers, the relevant vendor security pages are linked below rather than summarised here — their terms, not our characterisation of them, are what govern.

03

Who can access what

Accounts support single sign-on, multi-factor authentication and role-based access control, so permissions can follow your existing directory rather than being managed separately. API keys are scoped and revocable, JWT-based authentication governs session access, and administrative actions are captured in audit logs.

01

How to Report

• Email: security@parallellabs.app
• PGP Key: Download our PGP key for encrypted communications
• Trust Center: trust.parallellabs.app

02

What to Include

• Description of the vulnerability
• Steps to reproduce the issue
• Potential impact of the vulnerability
• Any proof-of-concept code (if applicable)
• Your contact information for follow-up

03

Our Commitment

• We will acknowledge receipt of your report within 48 hours
• We will provide regular updates on our progress
• We will notify you when the vulnerability is fixed
• We will credit you in our Hall of Fame (if desired)

In scope

• Our web application and its authenticated functionality.
• Our public API and MCP endpoints.
• Authentication, authorization, and tenant isolation issues — anything that lets one account reach another account’s data.

Out of scope

• Denial of service, volumetric, or resource-exhaustion testing.
• Social engineering, phishing, or physical attacks against our staff or offices.
• Findings from automated scanners with no demonstrated impact.
• Vulnerabilities in third-party services we consume — please report those to the vendor directly; their security pages are linked above.

What we ask

Test only against accounts you control, and use test data rather than real customer records. Do not access, modify, or retain data belonging to anyone else, and stop as soon as you have demonstrated the issue — proving a vulnerability exists does not require exploiting it further. Give us reasonable time to remediate before disclosing publicly.

What you can expect from us

• Acknowledgement of your report, typically within two business days.
• An assessment and severity triage once we have reproduced the issue.
• Progress updates through remediation, and confirmation when a fix ships.
• Credit in our Security Hall of Fame, if you would like it.