Security

Built to answer the questionnaire, not to dodge it.

Everything on this page is how the product behaves today, taken from the code and the infrastructure it runs on. Where something is not done yet, we say so.

Start your workspace

Signing in

No passwords, so none to steal.

Staff and customers sign in with a one-time link sent to their email. Staff can also use a Microsoft 365 account, from any organisation.

A link works once. One you ask for expires after fifteen minutes; an invitation from your team lasts seven days, and its page always asks for the six-digit code in the email. Claiming it is a single database statement, so a link clicked twelve times at once still makes one session.
Asking for a link always gets the same answer, whether or not the address has an account, and requests are rate limited per address and per caller.
Microsoft 365 sign-in is OpenID Connect with PKCE. The token is checked for this application, a matching nonce and an expiry before anyone is let in, and an installation can be pinned to a single directory.

Your sign-in linkWaiting

roost.tellparrot.com/auth/verify?token=…

SentExpires at 15 minutes

Used oncethen it is spent
Twelve clicks at onceone session
Or Microsoft 365your work account

Who can do what

One permission matrix, read by every screen and every action.

Roles live in one file, not in scattered checks. Every staff server action asks the matrix for a capability. A test fails if one only asks whether someone is on the team, unless the reason is written beside it.

One permission matrix10 roles

	Owner	Admin	Data steward	Fundraiser	Member services	Staff	Coordinator	Director	Finance	Viewer
See people
Export lists
Write notes
Build segments
Decide member requests
Manage feeds
Keep the books
Read the audit trail
Change settings
Erase a person

A slice of the matrix, drawn from the same function the product asks

Export

Reading is not downloading

Viewing one record and exporting ten thousand are separate capabilities. The second is the one that shows up in a breach.

Erase

One destructive act, for admins

Erasing a person is the only action that destroys data rather than annotating it. It is admin-only and recorded.

Branches

Access that follows the tree

Staff can be narrowed to a branch and everything beneath it. Owners and admins always see the whole workspace.

The record

Nothing changes quietly.

Audit trail

Who did what, and when

Staff and customer actions are written to the audit trail. Exports and erasures are recorded in full. An action the viewer does not recognise still shows.

The master

No edits in place

Roost never edits a person locally. A correction goes to TellParrot as a request, a person reviews it, and it returns in the next delivery.

Deliveries

Signed, and checked

Every delivery from TellParrot is signed. Roost checks the signature over the exact bytes received before anything lands.

Keys

Encrypted at rest

Stripe, Mailchimp, Meta and TellParrot keys, feed secrets and mailbox tokens are stored with AES-256-GCM. A database read alone never yields a live secret.

Where it runs

One region, a private database, and evidence that lasts.

Every record belongs to one workspace, and staff screens read within their own. The workspace lives in one place.

Region

Microsoft Azure, West US 3

This Roost runs in Microsoft Azure, West US 3 (Arizona), and your workspace's data is held there. Nothing of it is in any other cell.

Network

The database is not on the internet

No public endpoint. It sits in a private network, reached through a private DNS zone, and every connection is forced onto TLS.

Backups

Geo-redundant, fourteen days back

Point-in-time restore across the last fourteen days, with backups copied to the paired region, East US, in the United States.

Logs

Kept for a year

Application logs are retained for 365 days, long enough to cover an audit window rather than expire inside it.

Files

Private, with versions

Kept files live in a private container. Earlier versions and deleted files can be recovered for thirty days.

Secrets

In a key vault, read by identity

Infrastructure secrets live in Azure Key Vault and the app reads them with its own managed identity. Nothing is clicked into place; it is all Terraform.

Not done yet: there is no web application firewall in front of the app, and the key vault and image registry endpoints are public, gated by Azure identity rather than by network. Both are written down, with the reasons, rather than left for a questionnaire to find.

Next step

Ask us the hard questions.

Or start a workspace and look for yourself. The audit trail is on from day one.

Start your workspace See how it works