Security & trust

Parasync is built for organizations that need to run agentic workflows — including workflows that touch real third-party accounts like Gmail and Outlook, and real payments — without giving up control over their data or oversight of what their agents can do. This page summarizes the principles the platform is built on today, and the direction we’re investing in as the platform matures.

Organization & data isolation

Every organization, agent, chat, and message is scoped to the organization or individual that owns it and protected by row-level access control enforced at the database layer — membership, ownership, and connection status determine what can be read or written, not just what the application chooses to display. A user connected to a shared agent gets their own isolated chat history and workspace, invisible to every other user connected to that same agent, including the agent’s own creator.

Least-privilege agents

Agents only see the role, goal, and backstory you configure for them, and only reach the tools, secrets, and connected third-party accounts explicitly attached to them. Nothing is granted to an agent by default beyond what it needs to do its job. Where an agent is shared with other users, its creator can independently control which tools and connectors are available to connected users versus kept for their own use only.

Credential encryption

Admin-configured secrets, per-user API keys, and OAuth tokens for connected accounts (such as Gmail or Outlook) are encrypted at rest using authenticated encryption, and are only ever decrypted momentarily, server-side, at the point a specific action requires them — for example, the instant an agent sends an email through a connected account. Decrypted values are never returned to any browser client, and are never visible to the agent’s creator or to other connected users.

Authentication

Sign-in is handled entirely through Supabase Auth (email/password and Google OAuth) — we do not implement or store custom authentication logic, relying instead on a dedicated, audited auth provider. Connecting a third-party account (like Gmail or Outlook) to an agent uses that provider’s own OAuth consent flow — we never see or ask for your third-party account password.

Sandboxed code execution

Custom tools and platform tools that execute code run in an isolated execution service, separate from the service that handles your conversations and credentials. That execution service has no direct access to your database, secrets, or other customers’ data — any file or credential it needs is passed to it explicitly, for one call at a time.

Payments

Wallet top-ups are processed by Razorpay. We do not handle or store your full card number, UPI PIN, or netbanking credentials — those are collected directly by Razorpay under its own PCI-DSS-compliant infrastructure. Wallet funds are only ever added to your account after we receive a signed, verified confirmation directly from Razorpay’s servers — never based solely on what your browser reports back after a payment, which protects against a lost connection or closed tab resulting in a missed or duplicated top-up.

Visibility into agent activity

Every message and status transition passing through an agent’s chat is recorded, so you can see what an agent was asked, what it decided, and when — not just the final result.

Responsible disclosure

If you believe you’ve found a security issue in Parasync, please report it to team@parasync.in rather than disclosing it publicly. Please include enough detail for us to reproduce the issue. We take all reports seriously, will acknowledge receipt promptly, and will keep you updated as we investigate and remediate.

Questions from your security team

If you’re evaluating Parasync for enterprise use and have specific compliance, infrastructure, or data-handling questions, reach out via our Contact page— we’re happy to walk through the architecture directly.