parımTry Pariom →
Security & trust

Read-only by architecture.
No write access, ever.

Pariom touches one of the most sensitive systems a company runs — its metrics. We treat that as a hard architectural constraint, not a compliance checklist. This page is what we send your IT director. We are an early-stage product; we tell you exactly what's in place today and what isn't yet.

All systems operationalBuilt on Vercel · Supabase (AWS) · Anthropic
01 · Architecture

No write tokens. Ever.

For reconciliation checks against your own database or warehouse, we only ever run a single, read-only SELECT against the query you configure — the query runner rejects anything else. The OAuth grants we request from QuickBooks and Xero for the memo tool are read-scoped: we cannot post a journal entry, modify a contact, or invoice a customer.

Tenant model
Shared Postgres database (Supabase/AWS) with row-level security enforced on every table — each user can only read or write their own organization's rows.
Connection credentials
Database and warehouse credentials you provide for checks are encrypted at rest with AES-256-GCM and decrypted only server-side, at check-run time.
Query guard
Reconciliation queries are restricted to a single SELECT statement, and outbound connections are blocked from resolving to private or internal network ranges (SSRF protection).
Encryption in transit
TLS 1.3, managed via Vercel and Supabase infrastructure.
Authentication
Supabase Auth with email/password and OAuth. Two-factor authentication (TOTP) available on your account.
Ingestion auth
Push-mode data ingestion is authenticated with HMAC-signed, timing-safe-compared secrets.
Rate limiting
Unauthenticated API endpoints are rate-limited (Upstash Redis) to reduce abuse surface.
Deletion
Account and data deletion on request, honored within 30 days — see our Privacy Policy.
02 · Compliance

Infrastructure compliance. Privacy law.

Infrastructure

We build on Vercel, Supabase, and AWS — each maintains its own compliance program; see their published certifications.

GDPR

Data processing agreement available on request. Data subject requests handled within 30 days via security@pariom.ai.

CCPA

California residents can request deletion or access to personal data. Email security@pariom.ai.

HIPAA

Not in scope. Healthcare customers should not upload PHI.

03 · Subprocessors

Every vendor named. Every one audited.

Pariom does not subcontract data handling without disclosing it. The list below is the complete set of vendors who touch customer data.

Vercel
Application hosting, cron scheduling, edge network.
Supabase
Postgres database, authentication, and row-level security (AWS-hosted).
Anthropic
Claude — used for diagnostic briefs, memo generation, and Ask Pariom.
Resend
Transactional email delivery (digests, briefs, alerts).
Upstash
Redis-based rate limiting on unauthenticated endpoints.
Intuit / Xero
QuickBooks Online and Xero OAuth. Read-only access only.
Stripe
Reserved for future billing. Not active during the beta period.

Full subprocessor list: /legal/subprocessors

04 · Disclosure

Found something? Tell us.

Write to security@pariom.ai. We read every report and will acknowledge it and work with you on a fix timeline.

Email security teamDownload DPA