Security & Responsible Disclosure

How we protect your records

• Sign-in without passwords. You sign in with a one-time emailed code, and can add a passkey or an authenticator app. ParagonBooks holds no password to steal.
• Access checked on every request. Each person has a role in each organization (Owner, Admin, Bookkeeper, Accountant or Read-only). The server checks it on every request, for reading as well as changing, and the database keeps each organization’s records apart as a second barrier. Paragon has no access of its own; it acts as the person using it.
• An audit trail that can’t be rewritten. Every material change is recorded with who made it and when. The record can’t be edited or deleted.
• A tamper-proof ledger. Posted entries are chained together and anchored to a public timestamp, so anyone can check that they haven’t been altered since.
• Hosted in Canada. Production is hosted in Burnaby, British Columbia, Canada. The Subprocessors page lists the providers outside Canada.
• Export at any time. You can take a complete copy of your records, with a fingerprint for every file.

Reporting a vulnerability

Write to hello@altumo.com. Include:

• what you found and where;
• the steps to reproduce it, and any proof-of-concept;
• what an attacker could do with it;
• how to reach you.

We will confirm we received your report, keep you informed while we work on it, and tell you when it is fixed. We are glad to credit you once it is, if you would like.

In scope

• https://paragonbooks.net
• https://app.paragonbooks.net
• the ParagonBooks API and MCP server at https://app.paragonbooks.net

Out of scope

• social engineering or phishing of our staff or users;
• denial-of-service attacks, and testing that degrades the service for others;
• physical attacks;
• services run by other companies, including those on the Subprocessors page (report those to the company concerned);
• reports from automated scanners with no demonstrated impact.

Testing in good faith

When you look for vulnerabilities:

• use only accounts and organizations that you own, or that their owner has allowed you to test;
• don’t view, change or delete other people’s information. If you reach some by accident, stop, don’t keep it, and tell us;
• do no more than you need to show the problem;
• give us reasonable time to fix it before you disclose it to anyone else.

If you follow these rules, we will treat your research as authorized, won’t take legal action against you or ask anyone else to, and will work with you to understand and fix the problem. This doesn’t cover other companies’ systems, and it can’t bind them.

Bug bounty

We don’t pay rewards for reports at this time.

security.txt

Our contact details for security researchers are also published at /.well-known/security.txt.