What we operate, and how to check it

Each tenant runs in its own Kubernetes namespace, which starts from a deny-all network policy and is reopened only by an explicit per-workload allowlist.

Each tenant has a dedicated PostgreSQL database, and that tenant's database role is limited to it.

Tenant messaging is segregated by per-tenant messaging accounts, a cryptographic boundary the message broker enforces rather than application code.

Each tenant has a dedicated identity realm holding its users, sessions, tokens and brute-force policy, and an identity in one realm has no standing in another.

The components tenants share, among them the cluster, the database cluster and the frontend, are named in the docs alongside the limits of logical isolation.

Tenant data is hosted on Hetzner Cloud in Helsinki, Finland, inside the EU.

Change history is retained for 730 days and the security audit log for 90 days, and both bounds are enforced by scheduled jobs.

A tenant export is encrypted with AES-256-GCM before it reaches object storage, downloads through an authenticated route in the product, and is deleted after 7 days.

Deprovisioning runs a 30-day grace period, then drops the tenant database, identity realm, messaging account and stored exports.

Source credentials are stored AES-256-GCM encrypted in the tenant's own database, bound to their tenant and source, and read back only under an audited reveal grant.

Collectors read from your systems; Parascope has no write path back into your infrastructure.

Public traffic terminates at the edge over TLS, with a current client negotiating TLS 1.3; database segments carry TLS with server-certificate verification and reject plaintext connections.

Kubernetes Secrets are encrypted in etcd by the API server, under the encryption providers the node operating system's machine configuration supplies on every control-plane node.

Backup objects are encrypted before upload, XChaCha20-Poly1305 on write-ahead log archives, and the production configuration wrapper refuses to run unless backup encryption is switched on.

The at-rest encryption scope is published store by store, including the stores that are not encrypted and why they are not.

Access is team-based with explicit permissions and data scopes that begin empty, and only a superadmin changes team permissions.

TOTP enforcement is checked at the identity realm, the OIDC callback, session refresh and each authenticated request, the posture on that check is fail closed, and its staleness windows are published. The OIDC callback additionally asserts per-login proof from the token amr claim.

API keys are tiered as service, admin, readonly and user, and a user token expires within 365 days.

Authentication, permission, team and token events are recorded with actor, IP address and timestamp, exportable as CSV, and retained for 90 days.

Five failed logins lock the account, and further failures escalate the lockout up to one hour.

Dependency, container, secret and static-analysis scans block the merge, and none of them run as advisory.

Container images are signed with Cosign, keyless through Sigstore, on immutable commit-SHA tags, and the signature is attached in the production registry itself; the exact verify command is published and reproducible with pull access.

cosign verify \
  --certificate-identity-regexp "^https://github.com/parascope-io/parascope/.github/workflows/build-images.yml@refs/heads/main$" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  registry.parascope.io/parascope-api:sha-abc12345

Production deploys use immutable commit-SHA tags and hard-fail unless the running pod proves the build that was deployed.

Third-party CI actions are pinned to commit SHAs by a check in the merge gate, and Dockerfile base images are pinned by digest.

The on-prem appliance verifies an update image offline against a public key baked into its own root-owned trust tree before applying it, and fails closed on any appliance carrying that key.

Published first-party images are re-scanned weekly against a freshly downloaded CVE database, those legs are gated on the scanner's exit code, and a failing run alerts the operator.

The availability target is 99.9% monthly per tenant, counted from whether that tenant's API answers a health request with HTTP 200 inside five seconds.

Backups run at three layers: continuous write-ahead log archiving, daily per-tenant dumps, and an hourly off-provider mirror to Cloudflare R2.

A weekly job verifies the archive chain and restores tenant dumps into a throwaway server, checking each restored schema and its row counts against the live source.

Recovery targets are published as design targets with their measurement status stated, not as measured results.

Incident severities carry committed response times sized to the team that exists: one hour for critical, four hours for high.

Containment runs as single control-plane commands where response speed matters: tenant suspension, credential rotation and revocation, and per-appliance cut-off.

Affected tenants are notified of data exposure; as processor, Parascope notifies the affected controller within 72 hours under the GDPR's Article 33(2).

A published disclosure policy with safe harbor and stated response times covers the *.parascope.io services and the collector appliance image.

Two product surfaces send data to a language model provider; the collectors, the processor, the appliance and the email worker contain no provider call.

Both surfaces egress through one control-plane pod, and a tenant namespace runs default-deny egress with no policy permitting a provider endpoint.

Model output is validated before it drives an action and fails closed, and adversarial injection suites run in the pipeline that gates every merge.

What is sent, what Parascope retains and for how long, and what the provider retains are published surface by surface.