Built for sensitive immigration data.
Parasource handles some of the most consequential personal information a person will ever share with a piece of software. This page is how we think about protecting it — written for the people who will actually read it: your IT lead, your privacy counsel, your funders.
Four principles, applied everywhere.
These show up in the product, not just on this page. The design system has dedicated components for audit reasons, magic-link reveals, and confirmation tokens — they exist because the principles exist.
No PII in URLs, titles, or analytics
Applicant data is sensitive enough that a browser tab label is itself a leak. URLs and page titles carry case IDs, never names, A-Numbers, or anything the applicant typed. We load no third-party analytics or advertising trackers.
Magic links are revealed once
Intake links are shown to the caseworker exactly once, when they're created. We store only a one-way hash of each link, so a lost link can't be recovered. A new one is issued instead.
Audit on everything that matters
Restricted actions, such as generating forms, cross-organization access, and sending replies to clients, require a deliberate confirmation step. Sensitive actions are recorded in an audit log your org admin can review.
Tenant isolation by default
Your applicant data is scoped to your organization in the application, and automated cross-organization access tests run on every backend change. Cross-organization access is limited to narrow Parasource-staff workflows, requires an explicit confirmation, and is audited.
Compliance posture.
We tell you what's done, what's in progress, and what we're choosing not to do right now. Pretending a framework is finished when it isn't is the fastest way to lose your trust.
| Framework | Status | Detail |
|---|---|---|
| SOC 2 | Planned | We have not completed a SOC 2 examination and do not have a SOC 2 report. We are preparing for a SOC 2 Type I examination against the Security criteria, and will update this row when a report is issued. |
| CCPA / CPRA | Rights supported | We honor California privacy rights (to know, delete, correct, and opt out) for all U.S. users, and we treat a Global Privacy Control signal as an opt-out. Account holders can use the Privacy tab in settings; anyone can email privacy@parasource.ai. |
| GDPR / UK GDPR | Limited applicability | Parasource serves U.S. organizations and stores data in the United States. We do not currently offer EU or UK data residency. |
Data protection.
Encryption
- In transit
- HTTPS only, using TLS 1.2 or 1.3 at our load balancer, with HTTP Strict Transport Security (HSTS) on the web app. Our API also supports hybrid post-quantum key exchange (ML-KEM) for browsers that offer it. Connections from our servers to the database and cache also use TLS.
- At rest
- The database, the cache, and uploaded documents are all stored encrypted with AES-256.
- Application-layer encryption
- A-Numbers, Social Security numbers, dates of birth, and USCIS receipt numbers are additionally encrypted by the application before they are stored.
Hosting & residency
- Region
- AWS, hosted in the United States (primary region: us-east-2, Ohio).
- Availability
- The production database runs in a Multi-AZ configuration with automatic failover inside the region.
- Backups
- Automated daily database backups with point-in-time recovery, kept for 35 days.
Retention & deletion
- Default retention
- Applicant records are kept for your organization's engagement plus the records-retention period that applies to immigration legal services. Your organization can direct deletion sooner.
- Audit logs
- Append-only and retained for at least one year; an organization's audit history survives the organization's deletion. Long-term, tamper-evident audit archiving is in progress.
- Deletion
- Account profiles are deleted within 30 days of account closure, and your organization can direct deletion of applicant records at any time. Deleted database records age out of automated backups after 35 days.
Access controls.
Authentication
Staff sign in with email and password through Amazon Cognito, with a password policy that requires length and complexity. Staff can enroll an authenticator app (TOTP) for two-step sign-in; administrators can reset it, and the reset is audited. Applicants use single-use intake links. Single sign-on (SSO) is not yet available.
Authorization
Role-based: org admin, caseworker, viewer, and platform admin. Applicants reach only their own intake. Cross-organization routes require an additional confirmation step and are audited. They cannot be invoked silently.
Session management
Staff access tokens expire after 60 minutes and can be renewed for up to 12 hours, after which staff must sign in again. Idle staff sessions sign out after 30 minutes.
Audit trail
Sensitive actions, such as changes to applicant records and admin changes, are recorded with the actor and the time, plus a reason where one is required. Audit events are append-only and retained for at least one year; an organization's audit history survives the organization's deletion. Your org admin can review the log in the dashboard.
Privacy notice (in plain words).
The full privacy notice is the binding legal document. This summary is for quick reading — it does not replace it.
- What we collect
- The intake answers and documents your client provides, the questions they ask the assistant, account details for your staff, and basic technical data such as browser type and language. The Privacy Policy lists every category.
- What we don't collect
- We don't run third-party advertising or analytics trackers. We don't sell applicant data or share it for advertising.
- What we do with it
- We use intake answers to run the intake and deliver it to your organization, and to answer your client's questions in the assistant. We do not use applicant data to train AI models.
- How long we keep it
- For your organization's engagement plus the records-retention period for immigration legal services, unless your organization directs deletion sooner. Details are in the Privacy Policy.
- Client rights
- Access, correction, deletion, and a portable export. Account holders can use the Privacy tab in settings; anyone can email privacy@parasource.ai. We acknowledge requests within 10 business days and respond within 45 days.
- Children
- The service is not directed to children under 16, and we do not knowingly collect personal information from children under 16 without verifiable parental consent.
- Changes to this notice
- We post changes to the Privacy Policy with a new date. For material changes, we give additional notice, such as an in-product banner or an email to account holders, before they take effect.
Sub-processors.
The third parties that process applicant data on our behalf. The Privacy Policy is the authoritative list.
| Sub-processor | Purpose | Location |
|---|---|---|
| Amazon Web Services | Cloud hosting, database, and storage | United States |
| Vercel | Web hosting and delivery of the application | United States |
| Cloudflare | DNS and network security | United States |
| Anthropic | Large-language-model inference for the assistant | United States |
| Voyage AI | Embedding generation for search over legal sources and your organization's knowledge | United States |
| LangSmith (LangChain) | AI observability traces — direct identifiers redacted before send | United States |
| Sentry | Error monitoring — personal information scrubbed before send | United States |
| Resend | Transactional email (magic links, notifications); Amazon SES as fallback | United States |
Responsible disclosure.
If you've found a vulnerability, we want to hear from you. We do not pursue good-faith security research conducted under the terms below.
How to report
Email security@parasource.ai with reproduction steps and impact. We'll confirm receipt and keep you updated as we work on a fix.
Scope
The Parasource web app at parasource.ai and *.parasource.ai, and our public-facing APIs. Out of scope: physical attacks, social engineering of our staff, denial-of-service.
Safe harbor
Research conducted in good faith and within scope is authorized under our safe-harbor policy. Do not access applicant data beyond what's needed to demonstrate the issue, and do not disclose publicly until we've had a chance to fix.
Terms.
The Terms of Service and the Privacy Policy are the binding documents. One point is worth repeating here.
- Not legal advice
- Parasource provides general legal information, not legal advice. For advice about a specific situation, your client should talk to a licensed immigration attorney.
Read the Terms of Service · Read the Privacy Policy
Questions about the agreement? Contact legal@parasource.ai.