Parational Solutions Corporation — Security

Effective Date: 2026-08-14

Parational Solutions Corporation ("Parational," "we," "us," or "our"), headquartered in Vancouver, British Columbia, Canada, is committed to protecting the confidentiality, integrity, and availability of the data our customers entrust to us across our Services, including Parational Sync. This page describes the security practices we apply to our Services. For how we handle personal data, see our Privacy Policy.

1. Infrastructure and hosting

• Our Services are hosted on Microsoft Azure, using data centers located in Canada and the United States.
• We use infrastructure-as-code and controlled deployment pipelines so that production infrastructure changes are reviewed, versioned, and auditable.
• Production environments are segregated from staging and development environments.

2. Encryption

• In transit: All connections to our Services are encrypted using TLS 1.2 or higher.
• At rest: Customer data stored in our production databases and storage services is encrypted at rest using platform-managed encryption on Microsoft Azure.

3. Authentication and token security

Our integrations with third-party platforms (for example, legal practice management systems) use OAuth 2.0. We apply the following principles:

• Access and refresh tokens are stored encrypted; they are never stored in plaintext.
• Token refresh is automated so that long-lived credentials are not manually handled.
• Authorization codes are single-use and short-lived.
• Secrets and credentials are managed through Azure Key Vault rather than in application code or configuration files.

4. Access control

• Access to production systems and customer data follows role-based access control (RBAC) and the principle of least privilege.
• Administrative access is limited to authorized personnel who require it for their role.
• Application-level authorization enforces role-based permissions, and security-relevant events are logged for audit purposes.

5. Data residency and privacy

• Customer data is processed and stored in Microsoft Azure regions in Canada and the United States.
• We align our privacy practices with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). See our Privacy Policy for details on how we collect, use, and disclose personal data.

6. Data retention and deletion

• We retain customer data only as long as needed to provide the Services or as required by law.
• Customers may request deletion of their data by contacting us; we will delete customer data upon verified request, subject to any legal retention obligations.

7. Vulnerability management

• We monitor our application dependencies for known vulnerabilities and apply security updates as part of our regular development process.
• Automated dependency and vulnerability scanning runs in our build pipelines.
• Code changes are peer reviewed before being deployed to production.

8. Compliance

• We are actively pursuing a SOC 2 Type 1 attestation. Our SOC 2 program — covering security policies, access control, change management, incident response, and vendor management — is underway. We do not currently claim a completed SOC 2 attestation and will update this page when the attestation is issued.
• We do not claim any certification or attestation that we do not hold.

9. Incident response

• We maintain internal procedures for detecting, triaging, and responding to security incidents.
• If a security incident affects customer data, we will notify affected customers in accordance with applicable law and our contractual commitments.

10. Responsible disclosure

If you believe you have found a security vulnerability in any Parational service, please report it to us at security@parational.com. We ask that you:

• Provide enough detail for us to reproduce and validate the issue.
• Avoid accessing, modifying, or destroying data that does not belong to you.
• Give us a reasonable opportunity to remediate before any public disclosure.

We will acknowledge reports promptly and keep you informed of remediation progress where appropriate.

11. Contact

• Security reports: security@parational.com
• General inquiries and support: support@parational.com

Parational Solutions Corporation, Vancouver, British Columbia, Canada.