Trust & Security

Parry is an AI execution and control layer for enterprise procurement. It ingests a customer’s contracts, order forms, invoices and supplier correspondence, extracts the commercial terms, identifies risk and savings opportunities, and drafts and tracks supplier negotiations.

Parry.io Ltd. is an Israeli company (registration number 517334017) registered at Ein Harod 4/2, Tel Aviv-Yafo, Israel.

The system covered by this page, and by our SOC 2 examination, consists of:

• The Parry application — the web application at app.parry-io.com, its API, its background workers, and the databases behind them.
• The supporting infrastructure — the Google Cloud project that hosts it, defined and changed through infrastructure-as-code.

The following are outside that boundary: the marketing website you are reading now, internal demonstration environments, and the browser extension for live call assistance.

All customer data is stored and processed in the European Union. The application, its databases, its workers and its object storage run in Google Cloud’s europe-west3 (Frankfurt) region. Backups remain in the same region.

Where inference runs

Parry uses large language models to read and reason about documents. Inference is the one part of the pipeline whose location is not automatically the same as storage, so it is worth stating precisely rather than folding into the sentence above.

Inference runs in the European Union. Model calls are routed to the provider’s EU multi-region endpoint, in the same jurisdiction as the data at rest.

The residency control is enforced in code rather than by configuration convention: when it is on, every non-EU provider is filtered out of the routing chain before a request is made, and a request left with no eligible provider raises an error instead of falling back to one outside the EU.

If your organisation requires contractually guaranteed EU-only processing, raise it before you sign. We will state in writing which mode your deployment runs in and what we can and cannot guarantee, rather than have you discover it later.

Document text sent for inference is transient. It is not retained by the model provider and is not used to train models, under the terms of our agreement with them.

Encryption

• In transit: TLS 1.3 between customers and the platform, with HSTS preloaded. Database connections accept encrypted connections only.
• At rest: AES-256 on all storage and database volumes.
• Field level: OAuth tokens and other sensitive fields are encrypted by the application before they are written, so they are unreadable even with database access.

Access and tenant isolation

• Authentication is delegated to a dedicated identity provider. Parry never stores customer passwords.
• Every request is authorised against the caller’s organisation, and the database enforces row-level security independently of the application — a query that omits the tenant context returns nothing rather than everything.
• Production access is restricted to authorised personnel with multi-factor authentication. Changes to production access raise an alert.

Network

• A web application firewall with the OWASP core rule set in front of the platform.
• Per-IP rate limiting on the API, and automated blocking of known scanning tools.
• The application backend is not reachable from the public internet directly; the database has no public IP address at all.

Software development

• Every production change goes through a pull request with review, a linked change ticket, and cryptographically signed commits.
• Automated tests, static analysis, dependency scanning, container scanning and secret scanning all run before a change can merge, and a failure blocks the merge.
• Deployment to production is a deliberate, separately authorised action.

Monitoring and resilience

• Append-only audit logging with tamper detection on every security-relevant action.
• Alerting on availability, authentication anomalies and access changes.
• The primary database runs with a synchronous standby in a second availability zone, with point-in-time recovery and 35 days of retained backups.

These providers process customer data on our behalf. Each is under a data processing agreement, and the list is reviewed at least annually.

Transfers outside the EEA rely on the European Commission’s Standard Contractual Clauses. Full detail is in our Privacy Policy.

• SOC 2 — an examination is in progress with Kost Forer Gabbay & Kasierer, a member firm of Ernst & Young Global Limited, covering the Security and Confidentiality trust services criteria. A confirmation letter is available to customers and prospects on request.
• GDPR — Parry acts as a data processor under Article 28 for customer data. We offer a data processing agreement, maintain records of processing, and support data subject access and erasure requests.
• Penetration testing — the platform is tested by an independent external party on an annual basis.

Customer data is retained for the life of the customer agreement. On termination, or on a documented request, customer confidential information is disposed of according to our data disposal procedure. Individual erasure requests are handled through the same mechanism and cover derived data, not only the original document.

If you believe you have found a vulnerability, email security@parry-io.com. We will acknowledge within one business day. Please give us a reasonable opportunity to remediate before any public disclosure. We do not pursue legal action against researchers who act in good faith and do not access, modify or destroy customer data.

For availability commitments and support response targets, see our Service Level Agreement.