Security

Parley is a self-hosted tool that a team joins by following a link. That shapes everything below: the interesting questions are what a passcode actually protects, what an operator is trusted to configure correctly, and what a database dump would disclose.

These pages state what is enforced, what is deliberately not, and what is simply absent. Where something is absent there is a mitigation next to it — a gap with an answer is a decision, a gap without one is a hole.

Reviewing Parley for your organisation?

The Security review pack is a single page that collects the threat model, the data inventory, the supply-chain position and every known limitation, so you can read or print one document instead of eight.

OverviewThe security model in plain terms: what a passcode is and is not.Threat modelAssets, trust boundaries, who is in scope, and the risks accepted on purpose.AuthenticationAnonymous and OpenID Connect, cookies, tokens, and session lifetime.AuthorizationMembership, facilitator rights, and what the server checks on every request.Data and privacyEvery field of personal data Parley stores, and what it does not keep.Hardening checklistThe ordered list of things to get right before you expose it.CryptographyEvery algorithm Parley uses, the FIPS image, and what it does not cover.Supply chainDependencies, CI gates, the image, and digest-bound release provenance.Review packEverything above as one printable document.