Platform

Use Cases

Resources

Pricing

Docs

For AI

Start for free

Book a demo

Platform

Use Cases

Resources

Pricing

Docs

For AI

Start for free

Book a demo

Integration infrastructure your security team will clear.

Paragon powers product integrations and agent workflows for enterprises in regulated industries. SOC 2 Type II, HIPAA-ready, and GDPR compliant, with the option to self-host entirely inside your own cloud.

Go to Trust Center

Trusted by enterprise platforms and AI products to handle integrations at scale.

Security sits in the path, not on the side.

Paragon is the governed layer between your product, your agents, and the hundreds of systems they connect to. Every credential, connection, and action runs through one control plane with encryption, isolation, access control, and audit logging built in. You decide where that control plane lives: our SOC 2 audited cloud, a dedicated single-tenant environment, or fully inside your own VPC.

Data governance, by default.

Trust is built into every layer of the platform. These are the controls that decide where your data lives, who can reach it, and what gets recorded.

Data residency
Self-host in your own AWS, GCP, or Azure account, in your region. On our cloud, data is hosted in the United States today; an EU region is in progress.
Access and isolation
Multi-tenant isolation by default, with dedicated single-tenant environments available on the enterprise tier. Role-based access control and least-privilege enforced throughout.
Audit trails
An append-only audit log covering authentication, workflow execution, connection lifecycle, and administrative events. Export to your SIEM over webhook or S3.
Encryption and key management
Encrypted at rest with AES-256 and in transit with TLS 1.2 or higher. Bring your own keys (BYOK) on self-hosted and dedicated deployments.

Data residency
Self-host in your own AWS, GCP, or Azure account, in your region. On our cloud, data is hosted in the United States today; an EU region is in progress.
Access and isolation
Multi-tenant isolation by default, with dedicated single-tenant environments available on the enterprise tier. Role-based access control and least-privilege enforced throughout.
Audit trails
An append-only audit log covering authentication, workflow execution, connection lifecycle, and administrative events. Export to your SIEM over webhook or S3.
Encryption and key management
Encrypted at rest with AES-256 and in transit with TLS 1.2 or higher. Bring your own keys (BYOK) on self-hosted and dedicated deployments.

Data residency
Self-host in your own AWS, GCP, or Azure account, in your region. On our cloud, data is hosted in the United States today; an EU region is in progress.
Access and isolation
Multi-tenant isolation by default, with dedicated single-tenant environments available on the enterprise tier. Role-based access control and least-privilege enforced throughout.
Audit trails
An append-only audit log covering authentication, workflow execution, connection lifecycle, and administrative events. Export to your SIEM over webhook or S3.
Encryption and key management
Encrypted at rest with AES-256 and in transit with TLS 1.2 or higher. Bring your own keys (BYOK) on self-hosted and dedicated deployments.

Data residency
Self-host in your own AWS, GCP, or Azure account, in your region. On our cloud, data is hosted in the United States today; an EU region is in progress.
Access and isolation
Multi-tenant isolation by default, with dedicated single-tenant environments available on the enterprise tier. Role-based access control and least-privilege enforced throughout.
Audit trails
An append-only audit log covering authentication, workflow execution, connection lifecycle, and administrative events. Export to your SIEM over webhook or S3.
Encryption and key management
Encrypted at rest with AES-256 and in transit with TLS 1.2 or higher. Bring your own keys (BYOK) on self-hosted and dedicated deployments.

Internationally recognized compliance standards

Security is built into every layer of the platform, from the infrastructure we run to how we govern data for AI and agents. Independent auditors verify it on a recurring cycle, and the underlying reports are available in our Trust Center.

Go to Trust Center

SOC 2 TYPE II

AICPA

SOC2

TYPE II

Our platform is SOC 2 Type II audited — meaning we meet the highest standards for security, availability, and data confidentiality. We maintain strict internal controls and conduct regular independent audits.

HIPAA

HHS

HIPAA

PRIVACY

For customers handling sensitive healthcare data, we are fully HIPAA compliant. Our systems, policies, and procedures are designed to ensure privacy, security, and integrity of protected health information (PHI).

GDPR / CCPA / DPF

GDPR

CCPA

DPF

We are fully compliant with the General Data Protection Regulation (GDPR). User data is processed lawfully, transparently, and for a specific purpose. Our infrastructure is designed for privacy-first handling of personal data.

Sub-processors

DATA

SUB

PROC

We adhere to the internationally recognized standard for information security management. Our ISO 27001 certification ensures rigorous data protection, risk mitigation, and ongoing compliance to keep your data safe and secure.

ISO 27001 (in progress)

ISO

27001

ISMS

Currently in progress, certification expected in Q3 2026.

Out of network data processes

Some data leaves Paragon to ensure we remain compliant where we operate. We’ll always let you know which information is shared with 3rd parties.

License check

A deployment identifier and version number, used to validate the self-hosted license.

License check

A deployment identifier and version number, used to validate the self-hosted license.

License check

A deployment identifier and version number, used to validate the self-hosted license.

Billing metadata

Aggregate usage counts for metered billing. No record contents, no user identities.

Billing metadata

Aggregate usage counts for metered billing. No record contents, no user identities.

Optional analytics

Anonymized product telemetry for product development. Disabled by default.

Optional analytics

Anonymized product telemetry for product development. Disabled by default.

Proven impact
with measurable metrics

We’re constantly monitoring our security infrastructure and measure our efficiency on a frequent basis.

Trusted by Enterprise platforms

Critical incidents in the last 12 months

0

Platform uptime

50.0%

Transactions handled

0.0B

Enterprise-grade security and controls that works in your existing stack

SAML SSO + OIDC

SCIM provisioning

SIEM log streaming

Private networking and IP allowlisting

Customer-managed encryption keys (BYOK)

Per-customer isolation

Production scale

Least-privilege installation

Managed on-prem

Forward deployment

“AI safety is inseparable from innovation at Paragon.
Ensuring our systems are developed, deployed, and used safely remains at the core of our strategy.”

Brandon Foo

CEO, Paragon

Built for agents, governed like everything else.

Workflow tools were built for humans clicking buttons. Agents act autonomously, so the controls have to be built in by default. Paragon gives your AI products and internal agents a governed action surface across hundreds of systems, without rebuilding the audit, retry, and permission work every time.

One control plane for human and agent actions

Agent actions run on the same audit, scoping, and revocation controls as your human-triggered integrations. Logged, attributable, and revocable from a single control plane.

Access and governance

Per-agent permissions, scoping, and rate limiting on every run.

Audit & compliance

A new audit surface for autonomous workflows, on the same pipeline as human-triggered integrations and available for SIEM export.

Revocation

Revoke an agent’s access from one place, instantly.

AICPA

SOC2

TYPE II

HIPAA

CERTIFIED

GDPR

CERTIFIED

VPC

compatible

Run Paragon in your cloud, or ours.

Self-hosted in your VPC

Run the entire platform inside your own AWS, GCP, or Azure account. Connectors, credentials, and integration traffic stay inside your perimeter and inherit your network controls. Bring your own keys.

Self-hosted in your VPC

Run the entire platform inside your own AWS, GCP, or Azure account. Connectors, credentials, and integration traffic stay inside your perimeter and inherit your network controls. Bring your own keys.

Self-hosted in your VPC

Run the entire platform inside your own AWS, GCP, or Azure account. Connectors, credentials, and integration traffic stay inside your perimeter and inherit your network controls. Bring your own keys.