IT and security FAQ

Pareo is available as SaaS or for operation in your own cloud environment.

A dedicated instance operated by Pareo is available on request. Operation in your own data centre (on-premises) is not part of our standard offer today, but we are happy to discuss it.

Pareo runs on Google Cloud in Belgium (region europe-west1). All stored data, backups included, stays in this region. See Security.

No. Your data is stored and processed in the EU, and the AI models also run in the EU (EU data residency). Two optional reference lookups (substance names to find a CAS number, and web search with your own key) go to US services. These services receive no personal data and no documents. See Data residency and processing.

See Subprocessors.

Yes. Each organisation's data is logically isolated from all other customers (logical tenant isolation, enforced with row-level security in the database). See Security.

All connections and all stored data are encrypted (TLS 1.2 or newer with HSTS, encryption at rest with AES-256). Particularly sensitive content, such as supplier replies and signatory contact details, is encrypted again with a separate key (field-level encryption), so it stays unreadable even in a copy of the database. Attacks from the internet are filtered before they reach Pareo (web application firewall, rate limiting), and only software that Pareo released can run (signed container images with an SBOM). See Security.

Pareo itself is not certified yet. Our infrastructure providers, Google Cloud and Amazon Web Services, are certified to ISO/IEC 27001 and SOC 2. Their certificates cover the infrastructure, we cover the application (shared responsibility model). Our own measures are part of the data processing agreement (TOMs under Art. 32 GDPR).

We welcome them. As a young company, we are flexible about how and when a penetration test takes place, for example by a tester you choose. Talk to us. We also check our platform for vulnerabilities regularly with automated tools (dependency, container and secret scanning).

Only the platform's technical administrators have access to the production system, and only with the rights they need for it (least privilege). Each access requires multi-factor authentication (MFA) and is logged (audit logging). We review the access rights every quarter (recertification). This follows ISO/IEC 27001, Annex A 5.15, 5.18, 8.2 and 8.15. See Security.

We notify affected customers of a personal data breach within 48 hours (notification to the controller under Art. 33(2) GDPR). To report a vulnerability, write to (responsible disclosure).

The database is backed up every day, and it can be restored to any moment of the last 7 days (point-in-time recovery). Backups stay in the EU. See Security.

Yes. You are the controller, and Pareo is the processor under Art. 28 GDPR. The agreement includes our technical and organisational measures (TOMs) and the list of subprocessors. We send it to you on request.

Pareo stores only what these purposes need (data minimisation under Art. 5 GDPR). The full list with legal bases is in Data residency and processing.

Each type of data has a fixed retention period (retention and deletion policy). On your instruction, we erase your organisation's data. Backups are deleted when their retention period ends. See Data residency and processing.

Yes. You can download your documents and every output Pareo made at any time. Product data exports in open standard formats (Asset Administration Shell/AAS, IPC-1752A). See Getting data out of Pareo (customer login required).

Pareo uses large language models (LLMs) from established providers, through their EU cloud regions. The Subprocessors page names the current provider and region.

No. The model providers process your data only to generate the response in question, and by contract they do not use it to train their models. Pareo trains its own models only on synthetic data, never on customer data.

No. Pareo is built to work with different models (model-agnostic architecture). We can change the model without a change in how you work. A new provider is a new subprocessor, so we tell you before it happens.

Every value that Pareo extracts links to the exact place in its source document (source grounding). Pareo shows how sure it is (confidence score), and a person approves each answer before it goes out (human in the loop). See Extraction and citations (customer login required).

Yes, through SAML 2.0, for example with Microsoft Entra ID, Okta and Google Workspace. Your identity provider (IdP) handles multi-factor authentication (MFA). Users are created at their first sign-in (just-in-time provisioning), and you can make SSO the only way to sign in (SSO enforcement). See Single sign-on (customer login required).

Each user has a role that sets their permissions (role-based access control, RBAC): Admin for settings and user management, Operator for the daily work. With SSO, your identity provider sets the role: groups from your directory map to Pareo roles at every sign-in (identity federation with role mapping). See Manage users and roles (customer login required).

Yes. Pareo logs every change to a record with the old value, the new value, the user and the time (audit trail). Each compliance value also shows its source (data provenance).

Onboarding can start with file exports from your systems. The connection to SAP or Teamcenter through the Pareo Connector follows when you need it.

Through the Pareo Connector, a standalone program that you run inside your network. It is a single executable with no further dependencies and runs as a container or directly on a Linux or Windows server. The connector reads SAP and Teamcenter through their standard interfaces (OData, SOA) and sends the data to Pareo over HTTPS (signed requests). Pareo never connects into your network, and no port is opened (outbound-only, no inbound firewall rules). See Connector security.

Write-back is disabled by default.

No. Pareo works beside your existing systems. These systems stay the source of your master data (system of record). Pareo covers what these systems are not designed for: collecting, assessing and evidencing compliance data.

Because most compliance data does not originate in your master data system. It comes from your suppliers and from regulators.

Pareo is built for the people responsible for compliance, not for master data maintenance. The result still reaches your master data system: with write-back, the compliance status is where your processes need it, for example for a check at purchase order or release.

Yes. Pareo supports catalogues with hundreds of thousands of parts and multi-level bills of materials. Even at this size, rule changes take effect immediately: before you save, Pareo shows which materials, products and answers change (real-time rule evaluation).

Send it to . We also send the data processing agreement and our technical and organisational measures on request.