Pariom touches the most sensitive system a mid-market company runs — its books. We treat that responsibility as a hard architectural constraint, not a compliance checklist. This page is what we send your IT director.
The OAuth grants we request from QuickBooks, Xero, and other source systems are read-scoped. We cannot post a journal entry, modify a contact, or invoice a customer even if we wanted to. The lack of write capability is not a policy — it is the cryptographic limit of the tokens we hold.
We build on AWS, Supabase, Anthropic, and Stripe — all SOC 2 Type II certified.
Data processing agreement available on request. Data subject requests handled within 30 days via security@pariom.ai.
California residents can request deletion or access to personal data. Email security@pariom.ai.
Not in scope. Healthcare customers should not upload PHI.
Pariom does not subcontract data handling without disclosing it. The list below is the complete set of vendors who touch customer data.
Full subprocessor list: /legal/subprocessors
Write to security@pariom.ai. We respond inside 24 hours with an acknowledgment and a timeline. Bounty rewards scale with severity. We name researchers on this page once a fix ships.