Security overview
Current Parix access controls, account protections, audit surfaces, and network boundary.
Parix security is built from several controls that apply at different boundaries. No single control replaces the others.
| Boundary | Current control |
|---|---|
| Account | Verified email, password or Google sign-in, passkeys, optional TOTP 2FA for password accounts, sessions, and a 15-day security log. |
| Organization | Active membership plus fixed owner, admin, and member roles. |
| API credential | Organization binding, optional database binding, and db:read plus db:write API scopes. |
| Database request | Organization and database authorization, plan quota checks, and provider-aware gateway routing. |
| TigerBeetle network | Gateway-only customer access; replica addresses and the native protocol are not exposed as a product surface. |
| Administrative history | Account security log and a separate organization audit stream. |
Start with these controls
- Add a passkey under Settings → Account.
- If you use password sign-in, enable TOTP two-factor authentication and store the backup codes separately.
- Review Settings → Sessions and revoke devices you do not recognize.
- Generate a separate database-scoped API key for each application or deployment.
- Store API key values in a secret manager and rotate them on a documented schedule.
- Review the account security log and organization audit log after any suspected compromise.
Current least-privilege limits
The dashboard currently provides database scope, not read/write scope, for API keys. Every generated API key authenticates with both db:read and db:write. A read-only API key is not a shipped option, so the smallest current application credential is a key bound to one database.
Organization roles are also fixed. There are no custom roles, per-database members, or an organization policy that requires every member to enable passkeys or 2FA.
Security boundaries are not compliance claims
Gateway-only access establishes the supported request route and blocks direct customer access to TigerBeetle replicas. It does not, by itself, document an encryption-at-rest policy, customer private-network connectivity, a compliance certification, or a contractual data-handling guarantee.
Use the applicable Parix contract and security documentation for those requirements. Do not infer them from the topology described in these product docs.