Security
Parlare stores customer data in Canada, removes high-risk personal information before anything reaches an AI model, and keeps each organization's data separate in the database. This page says what is in place, what is not yet, and the plan. For the live control list, our sub-processors and copies of our policies, visit the Parlare Trust Center. You can also email security@parlare.app.
1. Where your data lives
- Database and sign-in: Supabase, on AWS in Montreal, Canada.
- Application servers: Vercel, in Montreal, Canada.
- Backups: Google Cloud Storage, stored in both Montreal and Toronto, Canada. Backups are encrypted before upload, and Google does not hold the key.
- AI processing happens in the United States. Anthropic runs text practice and scoring. Google Gemini runs live voice practice. We do not say "nothing leaves Canada", because it does.
Every sub-processor is named in section 5 of our Privacy Policy.
2. Personal information is removed before it reaches the AI
Every practice message, uploaded transcript and note passes through three layers before it is scored:
- Blocked in the browser. Social insurance numbers, US social security numbers, bank account and transit numbers, card numbers, and Ontario, Quebec and British Columbia health card numbers are detected before anything is sent. The text is held back and the user is told why.
- Removed in the browser. Email addresses, phone numbers and clinical details are masked before sending.
- Checked again on the server. A pattern-based scanner (Microsoft Presidio) checks again for structured identifiers, and a final sweep runs before a record is saved.
What these layers do not do: names inside a conversation are not removed automatically, so we ask users to use made-up names. Live voice audio reaches the voice provider before these text checks can run on it.
3. Who can see what
Access is enforced by row-level security in the database, so the rules hold no matter how the data is requested.
- The user sees their own practice records, scores and feedback.
- A leader in their organization sees who practiced, how often and how it scored, not the conversation itself.
- Their organization's administrator can read their own organization's records, including conversation text, but cannot edit or delete them.
- Other organizations see nothing.
- Parlare uses records only to provide and support the service.
A user cannot raise their own role, organization or plan. Only Parlare's server can, and those changes are written to an audit log the customer can read.
4. Sign-in and access
- Sign-in: email and password, Google, or SAML 2.0 single sign-on with your own identity provider, connected per customer on request.
- Two-factor authentication: available to every user through an authenticator app. Parlare's own operator access requires it, enforced on the server.
- Customer audit log: administrators can see administrative actions in their organization, plus sign-in and two-factor events. The log cannot be edited from the application.
- Access reviews: every quarter, Parlare reviews who holds administrator roles and every service that can reach production.
5. Application and infrastructure
- Encryption: all traffic uses TLS with strict transport security (HSTS). Data at rest is encrypted with AES-256.
- Browser protections: a strict content security policy with no inline scripts allowed, clickjacking protection, and the camera disabled across the platform.
- Input checks and limits: every request is validated against a defined schema, and requests are rate-limited.
- Code changes: every change goes through a pull request, an automated test suite runs on it, and the founder approves each merge. The main branch is protected against deletion and history rewrites.
- Secrets: held in the hosting platform, never in code. Secret scanning with push protection is on, and dependency alerts flag vulnerable libraries.
6. Monitoring, incidents and backups
- Uptime is checked every five minutes from six regions, and an outage alerts Parlare by email.
- Server errors are reported without customer content and alert Parlare by email. Account-security changes (two-factor removed, password changed, account deleted, admin role granted, member invited) also alert by email.
- Incident response: a written plan covers severity levels, containment, evidence and notification, including breach reporting under Canada's privacy law (PIPEDA). Customers affected by an incident involving their data are told promptly.
- Backups run automatically twice a day, encrypted to a key only Parlare holds, and Parlare is alerted if one fails or is missed.
- Disaster recovery: a written plan sets recovery targets. It was rehearsed on 6 October 2026: a backup was restored into a fresh database in Montreal, intact, in 31 minutes.
7. Retention and ownership
- Customers own their data. Each person's past sessions shape their own coaching: their next recommended practice and their progress over time. Usage data, such as features used and errors, helps improve the product. Parlare does not sell customer data and does not use it to train AI models.
- Conversation text is deleted automatically after 12 months, or sooner if the organization sets a shorter period. Scores and basic session details are kept while the account is active. Deleted text can remain in an encrypted backup for up to 12 more months.
- When an account is deleted, its personal data is deleted within 30 days, except where the law requires otherwise. At the end of a contract, Parlare exports the organization's records on request and then deletes them.
- Text sent for scoring is handled under Anthropic's commercial API terms, and Anthropic may keep it for up to 30 days. Parlare has asked Anthropic for a zero-data-retention agreement. It is not yet in place.
8. Security policies
Parlare runs its security program under 15 written policies, first approved on 14 October 2026 and reviewed every year. They cover information security and acceptable use, access control, asset management, business continuity and disaster recovery, code of conduct, cryptography, data management, human resource security, incident response, security roles, operations security, physical security, risk management, secure development, and third-party management. Everyone given access to Parlare systems must accept them first. Customers can request copies through the Trust Center.
9. What we do not have yet
Parlare is a young company, and some controls larger vendors hold are still ahead. We list them so you do not have to find them.
- SOC 2 report: in progress. The SOC 2 Type II audit is underway with an independent CPA firm, covering Security, Confidentiality and Availability. Progress is shown on our Trust Center.
- Third-party penetration test: not yet done. Planned during the audit period.
- Zero-data-retention agreement with Anthropic: requested, not yet signed.
- Data processing agreement: available on request in contract terms.
- "Require two-factor for everyone" per organization: not yet available.
- Automated deprovisioning from your directory (SCIM): not yet available.
- Accessibility (WCAG) assessment: not yet assessed.
10. Reporting a security concern
Email security@parlare.app. We acknowledge reports within two business days.