Verify before you install
Container images and the Helm chart are published to the GitHub container registry with keyless signatures and a software bill of materials. The documentation shows how to verify a release yourself, with no key from us.
Deploy and security
Your cloud. Nothing leaves.
The entire Paridity platform, the control plane, the workers, the connectors, the metadata and the evidence, runs inside your own cloud account or VPC. There is no Paridity-hosted control plane and no Paridity-visible copy of your data. Whole categories of vendor risk do not exist in this design.
Data posture
What stays inside, and the one thing that goes out.
- Credentials, object names, evidence values: inside
- Connection credentials, queries, schema and column names, and every evidence value stay in your environment. Each deployment serves a single customer; isolation is the deployment boundary itself, not a shared database.
- Secrets are pointers, never stored
- A connection is a reference into your own secrets manager: AWS Secrets Manager, Azure Key Vault, Google Secret Manager, or Infisical self-hosted (HashiCorp Vault for customers who already run it). Connectors resolve the credential at run time. There is no Paridity credential store to compromise.
- The one outbound path: the licence service
- Activating a licence, and the daily refresh of its signed token, call the Paridity licence service. The call carries the licence key, a machine id derived from the installation, the product name and the platform. Never a credential, an object name or an evidence value. An installation that cannot reach the service keeps working on its last token for seven days.
- AI is bring-your-own-key
- AI assistance uses your own model provider, under your credential, from your vault. It summarizes and suggests; it never decides whether data is correct.
Access control
SAML single sign-on, OIDC tokens, role-based access, tenant-aware.
- Sign-on
- Interactive sign-on is SAML, live-verified against Okta and Microsoft Entra ID, with SCIM user and group provisioning. API and service-account access validates OIDC/JWT bearer tokens against your issuer.
- Roles and grants
- Platform and tenant administrators, operators, stewards, analysts, read-only viewers and auditors, with scoped grants, business-domain boundaries, sensitive-evidence access controls, and actor and IP attribution on administrative actions.
- Masking
- Raw field values are stored only when tenant, mapping and field policy all allow it, and masked fields are masked at query time as well.
- Audit trail
- Every terminal run status, every administrative action and every retention purge is written to the audit log with actor, entity, action, time and network attribution.
Evidence integrity
Append-only and tamper-evident.
Evidence tables are never updated or deleted except by the retention purge, which logs what it removed. Period evidence bundles are signed, carry a manifest, and chain to the previous bundle by hash. A run whose schema could not be verified, or that ran with reduced coverage, is labeled and excluded from pass counts rather than presented as clean.
Installation
Kubernetes with Helm, or Terraform for AWS, Azure and GCP.
Your Kubernetes, your IdP, your secrets backend
One chart installs the API, the workers and the UI. You bring the identity provider, the secrets backend and the databases; the chart carries no dev bypass and fails closed on TLS.
Modules for AWS, Azure and GCP
Terraform modules stand up the cluster, the database and the network paths in your account, applied and destroyed live on all three clouds as part of the release process.
Evaluation install. A single-node evaluation install, one VM, no cloud account, is in preparation for the trial, so a proof of value does not need a platform team on day one. Until then, every trial and Early Adopter install is assisted by us.
Fully on-premises and air-gapped deployment, with offline licence activation, is available at the Global Enterprise tier. Details: documentation.
Need the full security pack?
A security brief, the trust-center materials and the whitepaper are available to your security reviewers on request.