Built by an IT lead. Documented like one.
This page is the honest version of the vendor questionnaire: what we do, where things run, and what is still on the roadmap. Questions go to security@parzify.com.
Identity and access
Single sign-on
OIDC with your identity provider (Okta today). Authorization code flow with PKCE, state and nonce checks, per-company client credentials encrypted at rest.
Provisioning
SCIM 2.0. Bearer tokens are shown once, stored hashed, and rotating a token revokes the previous one. Every request is logged.
Admin authentication
Admins sign in with a password (scrypt-hashed) plus a time-based one-time code from an authenticator app. Companies require the authenticator for admins by default.
Sessions
Server-side sessions in the database; cookies are HttpOnly, Secure and SameSite, regenerated on login, and expire after 12 hours.
Roles
Two roles: admin and member. Members see the chart and directory; only admins reach identity settings, logs and people management.
Data
Tenant isolation
Every company is a tenant. Every database query is scoped by tenant id; there is no query path that crosses companies.
Encryption in transit
TLS 1.2 and above on every connection, automatic certificate management, HSTS. Plain HTTP is redirected.
Encryption at rest
Identity provider secrets and authenticator seeds are encrypted with AES-256-GCM before they are stored. Disks and backups are encrypted by the cloud provider.
What we store
Names, work emails, titles, departments, locations, manager relationships, optional photos and short bios. No passwords from your identity provider, no salary or HR data.
Deletion
Deactivating a person in your identity provider removes them from the chart. Deleting a company removes its data; backups age out within 90 days.
Infrastructure
Hosting
Production runs on Amazon Web Services in the United States (us-east-2, Ohio). The application, database and reverse proxy run in containers on a hardened host.
Network
Only ports 80 and 443 are reachable from the internet. Administrative access is over a private network only, with key-based SSH.
Backups
Database and photo backups nightly and before every release, copied to encrypted object storage with a write-only role. Daily full-disk snapshots kept for seven days. Restore is scripted and tested.
Deployment
Every change is tested (unit and end-to-end) before an image is built. Release images are immutable and tagged by commit. Production releases are manual approvals with a backup taken first.
Dependencies
Pinned versions, minimal runtime image, no build tooling in production containers.
Application security
Headers
Content Security Policy (scripts self-only), frame-ancestors none, Permissions-Policy, Referrer-Policy, X-Content-Type-Options and friends on every response.
Input handling
All request bodies validated against explicit schemas with unknown fields stripped. Rate limiting on authentication endpoints.
Photos
Uploaded images are re-encoded server-side and served only to signed-in members of the same company.
Audit trail
Admin actions, sign-ins and configuration changes are recorded with actor and timestamp; provisioning traffic is recorded per request.
Roadmap and honest gaps
Parzify is young and we would rather say so. In progress: centralised log retention, automated vulnerability scanning of release images, a formal incident response runbook, and a SOC 2 Type II audit. Not yet offered: single-tenant hosting, customer-managed encryption keys, regions outside the United States. If one of these blocks you, tell us; it helps us order the roadmap.
Report a vulnerability
security@parzify.com. We acknowledge within two business days and do not pursue good-faith researchers.
Subprocessors
Amazon Web Services (hosting, backups), Google Workspace (transactional email), Docker Hub (release images). Full list in the DPA.
Documents
Terms of service, privacy policy and data processing addendum are public. A security questionnaire response is available on request.
See it with your own directory.
Connect a test group first if you like. Nothing is written back to Okta, ever.