Skip to main content
Parousia Group

Trust centre

What the group can show you before you sign

How access is controlled, where data lives, which standards are held and which are only targeted, what is committed on availability, and who to reach when something goes wrong.

Evidence, not assurances

Everything on this page is either verifiable today or marked as not yet in place. A trust centre that only lists strengths is a brochure.

Security

How the group protects what it operates

The controls below apply to every solution the group operates, because they are inherited from one platform rather than implemented six times.

  • Least privilege, and it is recordedProduction access is granted per role and per environment, authenticated against one identity model, and every privileged action is logged where the person who took it cannot alter the log.
  • Encryption in transit and at restTraffic is encrypted end to end. Data at rest is encrypted with keys the group manages, and, where a customer requires it, with keys the customer manages.
  • Independent review before releaseNo change reaches production without a review by someone who did not write it. Security-relevant changes are reviewed by the security function as well.
  • Environments are separatedDevelopment, test and production are separate estates with separate credentials. Production data is never copied into a test environment.
  • Recovery is tested, not assumedBackups are taken on a defined schedule and restored on a defined schedule. A backup that has never been restored is not a backup.
  • Incident response with a named ownerEvery incident has a single owner from detection to review, and the corrective action is tracked to completion rather than logged and closed.

Data residency

Where the data stays

The group operates its own infrastructure. Customer data remains in the jurisdiction the customer chooses, and the group is able to say which systems hold it.

Group offices

Where a customer requires that data never leave a jurisdiction, that requirement is written into the contract and enforced in the architecture, not in a policy document.

Standards

What is held, and what is only targeted

The group engineers to the standards below. It does not currently hold a certificate against any of them, and that is stated here rather than implied away.

Certificates held

None. No certification body has issued the group a certificate against any of these standards. When one does, the certificate number and the issuing body will be published on this page.

Engineered to

  • ISO/IEC 27001
  • ISO/IEC 27701
  • ISO/IEC 22301
  • ISO 9001
  • PCI DSS
  • SOC 2
  • NIST SP 800-53
  • CIS Benchmarks
Compliance

Availability

What the group commits to

Service objectives are agreed per contract, because a payments rail and an education platform do not carry the same consequence. What is common to all of them is written below.

  • Objectives are contractualRecovery time and recovery point objectives are agreed in writing before a service goes live, and measured against afterwards.
  • Maintenance is announcedPlanned maintenance is notified in advance, in a window agreed with the customer, and never applied silently.
  • Incidents are reported to those affectedA customer affected by an incident is told, with what is known at the time, and told again when the review is complete.

Reporting

Who to reach, and how fast the group answers

Four routes, each with a stated response time. None of them is a contact form that disappears.

The documents behind this page

Each statement above is written out in full, with its regulatory basis, in the legal documents.