PlatformPublic page

Security

Pareo runs on Google Cloud in the EU. This page describes how we protect customer data. For where data is stored and processed, see Data residency and processing.

Hosting#

  • Pareo runs on Google Cloud in Belgium (europe-west1).
  • All stored customer data, including backups, stays in this region. Language models process content in the EU.
  • The database runs on a private network and has no public address.

Encryption#

  • All connections use HTTPS with TLS 1.2 or newer. HSTS is enforced.
  • All stored data is encrypted at rest with AES-256.
  • The application encrypts sensitive fields a second time, such as signatory contact details and supplier replies.

Sign-in#

  • Single sign-on with SAML 2.0, for example Microsoft Entra ID, Okta or Google Workspace. MFA follows your identity provider.
  • Passwords are hashed with bcrypt and checked against known data breaches.
  • Repeated failed sign-ins lock the account temporarily.
  • Sessions expire after 24 hours and end immediately at sign-out.

Tenant isolation#

  • Product, request, supplier and document data belong to one organisation.
  • The database enforces this boundary independently of the application.
  • The application alone separates user accounts (a person can belong to several organisations) and sign-in logs.

Network protection#

  • A web application firewall (Google Cloud Armor) filters all traffic that reaches the application.
  • Rate limits per client address protect the API.

Access by Pareo staff#

  • Production access is limited to three named people.
  • Access requires a Pareo Google account with enforced two-step verification.
  • Access rights are reviewed every quarter.
  • Administrative actions in Google Cloud and in the Pareo admin console are logged.
  • The infrastructure holds no long-lived credentials. Services and deployments authenticate with short-lived tokens.

Audit trail#

  • Every change to a record is logged with the old value, the new value, the user and the time.
  • Sign-ins, failed sign-ins and access to confidential data are logged.
  • Every compliance value shows its source: a document, SAP, a policy or a manual edit.

Software supply chain#

  • Every release is signed and comes with a software bill of materials (SBOM).
  • The deployment checks every signature. The production environment also refuses to run any image that the production release key did not sign, whatever tool deploys it.
  • Staging runs in a separate environment with its own keys. A staging build does not reach production.
  • An emergency override exists for an outage. Each use is logged.

Backup and recovery#

  • The database is backed up daily. Backups are kept for 7 days.
  • Point-in-time recovery restores the database to any moment in the last 7 days.

Incidents#

  • Pareo notifies affected customers of a personal data breach within 48 hours.

Contact#

  • Vulnerability reports and security questions:
  • Data processing agreement (Art. 28 GDPR): available on request
  • Subprocessors
securityarchitecture