Scope and roles
You are the controller of customer data, and Parsel is your processor. This addendum applies whenever Parsel processes personal data in customer data, such as names and addresses on invoices and receipts.
Processing on your instructions
We process customer data only to provide Parsel as described in the terms and as you configure it. We don’t use it to train shared models, and we ensure our staff are bound by confidentiality.
Security measures
- SOC 2 Type II controls, audited annually.
- AES-256 encryption at rest and TLS 1.2+ in transit.
- Role-based access with single sign-on and least privilege for staff.
- An audit log of every approval and sync.
More detail is on our security page.
Subprocessors
We use a small number of subprocessors, each bound by terms at least as protective as this addendum. We’ll give 30 days’ notice before adding one, and you can object.
| Category | Used for | Region |
|---|---|---|
| Cloud infrastructure | Hosting, storage and document processing | United States |
| Email delivery | Forwarded-bill inbox and service email | United States |
| Payments | Billing for paid plans (no document data) | United States |
| Support tooling | Support conversations you start | United States, EU |
Incident notification
If we become aware of a breach affecting customer data, we’ll tell you without undue delay and within 72 hours, with the details we have and what we’re doing about it.
Audits and assistance
On request, we’ll share our latest SOC 2 Type II report under NDA and help you answer data subject requests and impact assessments.
Return and deletion
You can export customer data at any time. When your account closes, we delete customer data within 30 days, and backups roll off within a further 35 days. To sign a countersigned copy of this addendum, contact our security team.