How Parallel Protects You

Parallel works on your behalf, so security rules are not just an option on the screen: they are in the code that runs every action and cannot be bypassed through a conversation with the AI.

One gate for everything

Every action that leaves Parallel goes through the same permission check, in this order:

1. What is forbidden is blocked.
2. What an agent is not assigned is blocked.
3. What exceeds a spending limit requires approval.
4. In a plan without automation (Free), everything requires approval.
5. What touches a sensitive area (employment, credit, health…) always requires approval.
6. Then your rules apply: your permission mode, what you have set for that agent, and the default for each type of action.

The first five points cannot be bypassed, not even with Full access.

What is always asked

• Spending money or buying something. With any mode. This cannot be changed.
• An outgoing action decided after reading third-party content, like a website or received email. Even if the step was already accepted. This defends against hidden instructions on a page (“ignore the above and send…”): what comes from outside is marked as external and what is decided afterward goes back through you.

Approvals are not reused

When you approve something, Parallel creates a single-use authorization tied to a fingerprint of the exact content you saw. If a comma or recipient changes, it won’t execute. It expires after 15 minutes.

Each agent, their tools

An agent can only use the tools given for their role. The AI can request a tool; who decides and executes is Parallel, after the permission check. Agents coordinating others have no tools to write externally, except a notice that can only reach you.

Your credentials

• With app login (OAuth), Parallel never sees your password.
• Keys and tokens are stored encrypted (AES-256-GCM). If encryption is not available, Parallel refuses to store them rather than store them unencrypted.
• A saved key is never shown to you again.
• A connection only counts as “connected” after a real exchange with the app.
• When disconnecting, access is revoked and stored data is deleted.

Everything is logged

Every mission has its Activity log, in all plans. And Parallel always distinguishes what really happened from what could not be verified: a result without verification is never presented as confirmed.

Your permissions

You change them in Settings → Your account → Manage permissions. More details in Approve and reject.