Draft, not yet in force. This page is being reviewed and will apply once it is published with a date.
Security
Version 1.0 · Last updated [to fill: date, set when published]
A summary of how Paralleon CRM protects the data you keep in it. The full list of measures is the annex to our Data Processing Agreement.
Encryption
- In transit: every connection uses HTTPS (TLS 1.2 or later), between your browser and us and between us and our providers.
- At rest: the database and stored files are encrypted by our providers (AES-256).
- Mailbox access tokens are encrypted again with their own key (AES-256-GCM) before they are stored, so a copy of the database alone cannot open anyone's mailbox.
Workspace isolation
- Every record belongs to one workspace. Every read and write on the server checks that the person signed in is a member of that workspace and limits the query to it.
- A record from another workspace answers as if it did not exist. Automated tests check this on every change.
Access control
- Owners and members: only owners change settings, connected apps, members and billing.
- A sign-in session ends after 7 days without use, and sign-in attempts are rate-limited.
- Each person connects their own mailbox; nobody can connect a mailbox for someone else.
- Our own staff reach customer data only to give support you ask for, or to keep the service running, and every such action is logged.
Backups
Each workspace is backed up every night. Backups are encrypted, stored by workspace, kept for 30 days, and deleted with the workspace.
Logging and monitoring
We log sign-ins, changes to settings, connected apps and members, and every operator action, and keep the logs for the life of the workspace.
AI and your mail
- Mail reaches the AI only where a workspace owner has allowed it, and only for summaries and drafts.
- Mail sent to the AI is marked as untrusted text, and the model is told to ignore instructions inside it. Summaries and drafts get no tools; the assistant's tools only read inside your workspace, and it can never send anything or change a record without a person's click.
- Customer content is never used to train AI models.
Reporting a vulnerability
Write to contact.us@paralleon.com with the details and how to reproduce them. We acknowledge reports within 3 working days and will not take action against good-faith research that avoids other people's data and doesn't disrupt the service.
For IT admins
When someone in your organisation connects Microsoft 365, Paralleon CRM asks for these permissions. Microsoft's default settings let only an admin approve the mail and calendar permissions for a whole organisation; once approved, each person still connects their own mailbox.
| Permission | What it is for |
|---|---|
| User.Read, openid, email, profile | Knowing which account was connected |
| offline_access | Keeping the connection without asking the person to sign in again |
| Mail.Read | Showing the email between your people and the contacts and prospects in the CRM, next to their records. Mail with anyone else is skipped, not stored |
| Mail.Send | Sending an email the person has written or checked and confirmed with a click. Nothing is ever sent on its own |
| Calendars.Read | Showing meetings with your contacts on Today and on their records |
Paralleon CRM never changes or deletes mail or calendar events. To remove its access for everyone, delete the Paralleon CRM enterprise application in the Microsoft Entra admin centre. A person can remove it from their own account at myapps.microsoft.com.
For Google Workspace, the permissions are listed in the Privacy Policy's Google user data section, and an admin can trust or block the app in the Google Admin console under API controls.