generated: '2026-07-20'
method: derived
source: graphql/parabol-schema.graphql
docs: https://www.parabol.co/security-faq/
standards:
- id: graphql
  conforms: true
  evidence: Public GraphQL schema SDL served at action.parabol.co/graphql/schema.graphql
- id: relay-cursor-connections
  conforms: true
  evidence: List fields follow the Relay Connections spec (edges/node/cursor/pageInfo)
- id: graphql-subscriptions
  conforms: true
  evidence: Subscription root type with 5 channels over graphql-ws (WebSocket)
- id: oauth2
  conforms: false
  evidence: PAT bearer with scopes today; OAuth2 authorization-code is roadmap-only
- id: bearer-token-auth
  conforms: true
  evidence: RFC 6750 Bearer token in Authorization header (Personal Access Tokens)
- id: rfc9457-problem-details
  conforms: false
  evidence: GraphQL error model (top-level errors[] + StandardMutationError), not problem+json
- id: soc2-type2
  conforms: true
  evidence: Parabol maintains an active SOC 2 Type 2 certification (security FAQ)
- id: gdpr
  conforms: true
  evidence: Parabol is GDPR compliant with EU hosting option (security FAQ)
- id: caloppa
  conforms: true
  evidence: Adheres to California Online Privacy Protection Act (security FAQ)