Security at Parascope
What Parascope does to your infrastructure, where it runs, what certifications it holds today, and who operates it.
Most security reviews start with the same four questions: what does this thing do to my systems, where does my data live, what have you been audited against, and who is on the other end of the support address. This page answers them directly, including the answers that are less flattering, and points at the doc that carries the detail for each. There is no login or email form in front of any of it.
What Parascope does to your infrastructure
Parascope is an observer. It discovers assets and relationships through each source's own API and records what it finds, with history. It does not write to, modify, or control the systems it reads. There is no remediation engine behind it and no write path from the product back into your estate.
| Property | What it means |
|---|---|
| Read-only by design | Parascope asks each source for read-only credentials and calls read APIs. The Linux collector is the case worth knowing about: it opens an SSH session and streams a read-only shell script to the host over stdin, writing no files to the target and leaving no agent behind. OS Collection documents what that script reads. |
| EU hosting | The platform runs on Hetzner Cloud in Helsinki, Finland. Your infrastructure data is hosted and processed in the EU. |
| Isolated per tenant | Each tenant gets its own Kubernetes namespace, its own PostgreSQL database, its own messaging account, and its own identity realm. |
| On-prem option | For private or air-gapped estates, collectors run on an appliance inside your network and connect outbound to the platform. No inbound firewall rule is required. |
Source credentials you enter in Parascope are stored encrypted (AES-256-GCM) in your tenant's dedicated database and delivered only to your collectors over TLS; the platform's collectors read them one source at a time under an audited reveal grant. Encryption states the at-rest scope precisely, including what is not covered.
Compliance status
Parascope is not yet SOC 2 or ISO 27001 certified. No third-party audit has been performed; there is no report or certificate to send you today. Certification is planned, but not yet scheduled. If a vendor questionnaire asks whether we hold one, the answer is no.
| Framework | Status |
|---|---|
| SOC 2 Type I / Type II | Not yet certified. No audit performed; certification planned, not yet scheduled. |
| ISO 27001 | Not yet certified. No audit performed; certification planned, not yet scheduled. |
| GDPR | Not a certification. Parascope Limited acts as processor for tenant data; a data processing agreement is available on request and is in legal review, and sub-processors are published. |
| PCI DSS | Out of scope. Card details are entered on Stripe's hosted checkout; the platform stores Stripe customer and invoice identifiers only. |
What does exist is internal: readiness checklists covering the pre-launch security gate, hardening validation, and evidence retention. Those describe controls Parascope intends to hold to. They have not been examined by anyone outside the company.
The compensating move for an uncertified vendor is published evidence you can check without asking us. That is the control matrix: each control names the framework criterion it addresses and how to verify it. "Addresses a criterion" is not "complies with a framework", and the matrix does not claim it is. Compliance Posture carries the same mapping in prose, framework by framework.
Who operates Parascope
Parascope is built and run by Parascope Limited, an Irish private company (CRO number 810646, registered in Dublin). It is a solo founder-operator business with no employees, funded by the founder. That is unusual for infrastructure software sold to enterprises. The rest of this section answers the personnel and endpoint questions directly, in the terms that apply to a company of one.
Production access. One person holds production access. There is no second administrator, which also means there is no segregation of duties in the sense a SOC 2 reviewer means it. The compensating controls are the ones a single operator can run: administrative access to production infrastructure runs over an identity-managed private network and is not exposed on the public internet, changes go out as immutable image SHAs gated by merge-blocking CI, and account, permission, and token activity inside your tenant is recorded in an audit log you can read and export yourself. The operator account is protected by multi-factor authentication with a hardware security key.
Personnel security. There are no employees, so the personnel controls a questionnaire asks about (background screening, an onboarding and offboarding workflow, annual security-awareness training) have no subject to apply to. Those rows read "not applicable, no personnel". If headcount changes, this page changes with it.
Endpoint management. Operator endpoints are full-disk encrypted and screen-locked. There is no MDM or UEM enrolment, because there is no fleet to enrol. Standing up a device-management platform for a single machine would produce paperwork and little else.
Coverage. Parascope does not staff a 24/7 operations centre. The platform is monitored automatically, incidents are posted to the public status page, and the response times we are prepared to commit to are written down in Incident Response. They are sized for what one operator can hold to, which is why they are worth reading before you assume anything faster.
Reporting a security issue
Send security reports to security@parascope.io. The Vulnerability Disclosure Policy sets out scope, safe harbor for good-faith research, and the response timeline we work to (acknowledgment within 2 business days). Researchers who report valid issues are credited in release notes with their consent. There is no bounty program at this time.
Data protection questions (access, erasure, the DPA) go to privacy@parascope.io. Commercial questions go to hello@parascope.io.
Where the detail lives
| A reviewer asking about | Read |
|---|---|
| Tenant isolation and multi-tenancy | Tenant Isolation Architecture |
| Data collected, residency, retention | Data Handling and Retention |
| Encryption in transit, and what is encrypted at rest | Encryption |
| RBAC, API keys, MFA, audit log | Access Control and Authentication |
| AI features and what leaves the platform | AI Features and Your Data |
| Build pipeline and supply chain | Software Supply Chain |
| Patching, scanning, disclosure | Vulnerability Management |
| Backups, restore targets, DR | Availability, Backups and Disaster Recovery |
| Incident severities and notification | Incident Response |
| Third parties that touch your data | Subprocessors |
| Framework mapping | Compliance Posture |
Verify it yourself
- Company registration is public record: search CRO number 810646 on the Irish Companies Registration Office register at core.cro.ie.
- Platform availability and incident history are on the status page at parascope.instatus.com, which is hosted independently of the platform it reports on.
- The disclosure process is published in full at Vulnerability Disclosure Policy, including what we consider out of scope.
- Each control in the control matrix carries its own verify pointer, so you can check the ones that matter to your review for yourself.
- Anything still unanswered goes to security@parascope.io. It reaches the person who wrote the code.