Data Encryption

Customer-Managed Encryption Keys (CMEK) is available on Enterprise plans. Contact support@askparable.com to enable it for your organization.

By default, Parable encrypts your data at rest using Google-managed keys. With CMEK, you control the encryption keys that protect your data. The keys live in your Google Cloud KMS keyring inside Parable’s GCP project.

Rotate keys

Generate new key versions on your schedule. New data uses the latest version; existing data stays readable under previous versions.

Disable access

Disable your key to immediately revoke Parable’s ability to decrypt your data — even in an emergency.

Audit every operation

Google Cloud Audit Logs record every encrypt and decrypt with identity context.

Schedule destruction

Schedule key versions for destruction after a 24-hour waiting period (GCP-enforced).

What Parable controls vs. what you control

	Parable	You
KMS keyring creation	Created during provisioning	—
Keyring location	Set to your data region	—
Key rotation	Automatic every 90 days on `main`	Can trigger anytime
Encrypt / decrypt	Application service accounts use the keys	—
Key disable / enable	Infrastructure admins retain operational access and will not act without your written authorization	Can disable or enable at any time
Key destruction	Same written-authorization rule	Can schedule destruction
Audit log access	Internal monitoring	Read-only access to your keyring’s audit logs via a scoped log view

Disabling your key immediately stops Parable from accessing your data. Ingestion jobs fail and dashboards return errors until you re-enable the key. Plot results that a person’s browser stored before you disabled the key are encrypted under a key of that person’s access, not under your key, so that browser can still show them until the person signs out, their access changes, or 14 days pass. To stop them, suspend the people whose access must end in People. A suspended person is signed out at once, and a browser that opens Parable again gets no key to read what it stored. A tab that is still open stops when the server next refuses it: when the tab becomes visible again, on a refused read in the background, or at the latest on its first read five minutes after its last check. Rows that are on screen stay until then. See Incident response below.

Your keyring

When Parable provisions your Workspace, we create a dedicated KMS keyring in Parable’s GCP project. You receive IAM access to that keyring only.

Keyring name: tenant-{your-slug}-kms — {your-slug} is your Workspace slug.
Location: Same region as your data (for example us-east1).
Keys:
- main — Symmetric key for data at rest. Auto-rotates every 90 days (7776000s).
- credential-encryption — Asymmetric key for Provider credentials in transit.
- content-encryption — Asymmetric key for desktop-agent content. Provisioned on every Workspace keyring.

Sign in to GCP Console with corporate SSO (recommended) or a Google account. During onboarding, Parable configures the method and sends direct links to your keyring and audit logs.

SSO setup
Key management
Incident response
FAQ

Your IT admin creates an SSO application so your team can reach GCP Console to manage keys and view audit logs.

Parable provides the values marked as from Parable during onboarding. If you do not have them yet, contact support@askparable.com.

Most identity providers support OIDC and SAML. Use OIDC unless your organization requires SAML.

OIDC
SAML 2.0

Create a custom OIDC application:

Setting	Value
App name	`Parable CMEK Access` (or any name your team prefers)
Redirect URI	Provided by Parable
Login URL	Provided by Parable
Grant type	Authorization Code
Client authentication	Client Secret Basic
Scopes	`openid`, `profile`, `email`

Create the OIDC application

In your IdP admin console, create a custom OIDC application. Enter the Redirect URI and Login URL from Parable.

Assign users or groups

Assign the people who should manage keys. You can add or remove them later without contacting Parable.

Send credentials to Parable

Share Client ID, Client Secret, and Issuer URL (for example https://your-org.okta.com/ or https://oauth.id.jumpcloud.com/) through a secure channel.

Parable completes configuration

Parable sends a GCP Console sign-in link, a keyring link, and an audit-log link. Your team can also open GCP from the app in your IdP portal.

Okta

Applications → Create App Integration → OIDC - OpenID Connect → Web Application
Set the Sign-in redirect URI to the Redirect URI from Parable
Assign users or groups
Copy Client ID and Client Secret from the General tab
Issuer URL is https://your-org.okta.com/

Microsoft Entra ID

App registrations → New registration
Set the Redirect URI (Web) to the Redirect URI from Parable
Certificates & secrets → create a client secret
Copy Application (client) ID and the secret value
Issuer URL is https://login.microsoftonline.com/{tenant-id}/v2.0

JumpCloud

SSO Applications → Add New Application → Custom OIDC App
Set Redirect URI and Login URL from Parable
Client Authentication Type: Client Secret Basic
Check Email and Profile under Standard Scopes
Assign your test user or group
Copy Client ID and Client Secret
Issuer URL is https://oauth.id.jumpcloud.com/

Create a custom SAML application:

Setting	Value
App name	`Parable CMEK Access` (or any name your team prefers)
SP Entity ID (Audience)	Provided by Parable
ACS URL (Reply URL)	Provided by Parable
Login URL	Provided by Parable
NameID Format	Email or Persistent

The SAML application must enable HTTP-Redirect binding. GCP requires it for browser SSO. In most IdPs this is “Declare Redirect Endpoint” or “Enable HTTP-Redirect binding.”

Create the SAML application

Enter the SP Entity ID, ACS URL, and Login URL from Parable. Enable HTTP-Redirect, not only HTTP-POST.

Assign users or groups

Assign the people who should manage keys.

Send metadata to Parable

Share your IdP Metadata XML as a metadata URL (preferred) or a downloadable XML file.

Parable completes configuration

Parable sends a GCP Console sign-in link, a keyring link, and an audit-log link.

Okta

Applications → Create App Integration → SAML 2.0
Single sign-on URL = ACS URL from Parable
Audience URI (SP Entity ID) = SP Entity ID from Parable
Advanced Settings: Response = Signed
Assign users or groups
Copy the Metadata URL from the Sign On tab

Microsoft Entra ID

Enterprise applications → New application → Create your own application → Non-gallery
Single sign-on → SAML: Identifier = SP Entity ID, Reply URL = ACS URL
Download Federation Metadata XML
Assign users or groups

JumpCloud

SSO Applications → Add New Application → Custom SAML App
IdP Entity ID = a unique identifier
Set SP Entity ID and ACS URL from Parable
Enable Declare Redirect Endpoint
Assign your test user or group
Copy the Metadata URL from the SSO tab

After federation: you control access in your IdP, no Google account is required, and federated users do not accept a separate Google Terms of Service. To change IdP or rotate credentials, contact support@askparable.com.

Use the federated sign-in link from onboarding, or sign in at console.cloud.google.com with a Google account. If you do not have the link, contact support@askparable.com.

Open your keyring from the onboarding link

Your access is scoped to your keyring. You cannot list other customers’ keyrings.

Verify your keys

You should see main, credential-encryption, and content-encryption.

Rotate

Rotation creates a new key version. Existing data stays readable. GCP tracks which version encrypted each object.

Select the key

Open the main key.

Rotate the key

Click Rotate key, then confirm.

Verify the new version

The new version is Primary. Previous versions stay Enabled.

Parable rotates main every 90 days. Manual rotation adds a version early and does not reset that timer. credential-encryption and content-encryption do not auto-rotate.

Rotate `content-encryption`

Parable Pulse on each Mac wraps the activity it sends under the public half of content-encryption. Parable gives a Mac the newest Enabled version of the key. A Mac keeps the version it got until it gets the key again. Today a Mac gets the key when it enrolls.

Add a version

Open the content-encryption key and click Rotate key, or run gcloud kms keys versions create --key content-encryption --keyring tenant-{your-slug}-kms --location {region}.

Wait for the new version to be Enabled

The new version is Pending generation for a short time. Parable gives it to Macs within 5 minutes after it is Enabled.

Keep the old versions Enabled

A Mac that has an old version keeps using it. Disable an old version only after your Macs have moved to the new one. Contact support@askparable.com before you disable a content-encryption version.

When you disable or destroy a content-encryption version that a Mac still uses, Parable cannot read the activity that Mac sends. To see which versions are still in use, filter your audit log view on protoPayload.methodName="AsymmetricDecrypt" and read the version in protoPayload.resourceName.

Disable

Disabling a version blocks encrypt and decrypt for data under that version.

Disabling the primary version stops Parable services immediately. Only do this if you intend to stop all data access.

Open the key, use the three-dot menu on the version row, and choose Disable.

Re-enable

On a Disabled version, choose Enable. Services resume when the key is available again, usually in about 60 seconds.

Destroy

Destruction permanently deletes key material. Data encrypted only under that version becomes unreadable.

Do not destroy the primary version or any version that encrypted data you still need. Contact support@askparable.com before proceeding.

Schedule destruction from the version menu. GCP enforces a minimum 24-hour wait. You can Cancel destruction during that window.

Audit logs

Every encrypt, decrypt, and key-management operation is in Google Cloud Audit Logs. You have read-only access to a log view that contains only your Workspace’s KMS operations.

Open Logs Explorer

In GCP Console, go to Logging → Logs Explorer.

Select your log view

Refine scope → Log view → tenant-{your-slug}-kms-audit.

Run the query

Results are scoped to your organization.

Common filters (replace the slug):

resource.type="cloudkms_cryptokey"
resource.labels.key_ring_id="tenant-{your-slug}-kms"
protoPayload.methodName="Encrypt"

Use Decrypt for decrypts, or

protoPayload.methodName=~"(DestroyCryptoKeyVersion|ScheduleCryptoKeyVersionDestruction|RestoreCryptoKeyVersion|UpdateCryptoKey)"

for key-management events.

Field	Description
`protoPayload.methodName`	KMS operation
`protoPayload.authenticationInfo.principalEmail`	Who performed it
`protoPayload.resourceName`	Key version path
`timestamp`	When

KMS Data Access logs (encrypt/decrypt) are enabled on the Parable project. Key-management events are Admin Activity and are always on. For SIEM exports, contact support@askparable.com.

Disabling a key version makes GCP refuse encrypt/decrypt for that version within seconds. In-flight API requests that need decryption start failing. Background work stops retrying. Provider ingestion jobs fail. Encrypted data stays on disk; it is inaccessible until the key is available again. Dashboards show errors until you re-enable the key, except Plot results that a browser stored before (see the warning above).Parable application service accounts can encrypt and decrypt. They cannot enable or disable keys. Infrastructure administrators will not re-enable your key without your written authorization.

Use your federated link or Google account. Open tenant-{your-slug}-kms.

Re-enable the version

Three-dot menu → Enable.

Wait for services to resume

Services usually resume in about 60 seconds. Contact support if issues persist after 5 minutes.

Retry failed Provider syncs

Jobs that failed mid-run do not automatically retry. In Parable, open Providers and trigger a sync for any connection showing errors.

Before you disable a key in an incident: notify support@askparable.com or your account manager, note the time, disable the key, confirm errors appear, collect audit logs, then re-enable and retry Provider syncs when the incident is over.

Can Parable read my data while the key is disabled?

No. GCP refuses decrypts, including Parable service accounts.

Does this affect other customers?

No. Each Workspace has its own keyring.

I scheduled destruction by mistake

You have at least 24 hours to click Cancel destruction. Contact support@askparable.com.

Do I need a Google account?

Not necessarily. Corporate SSO (Workforce Identity Federation) is recommended. Google Workspace organizations can use a Google account instead.

What happens to existing data when I rotate?

Existing objects stay readable under the old version. New writes use the new primary. Parable does not automatically re-encrypt old data.

Can Parable re-enable a key I disabled?

Application accounts have encrypt/decrypt only. Infrastructure administrators have broader KMS access for operations and will not re-enable your key without written authorization.

Can Parable read credentials while the key is enabled?

Parable decrypts credentials when processing ingestion on your behalf. Every decrypt is in Cloud Audit Logs.

What if I destroy a version?

Key material is gone. Data encrypted only by that version is unreadable. GCP waits at least 24 hours.

How often does automatic rotation run?

main rotates every 90 days. The asymmetric keys do not auto-rotate. You can rotate any key manually.

Does CMEK cover data in transit?

CMEK is encryption at rest. Transit uses TLS 1.2+. Provider credentials are also wrapped with RSA-OAEP-4096 on credential-encryption before they reach Parable servers.

Whose GCP project holds the keyring?

Parable’s project. You have IAM on your keyring only.

How do I find my slug?

It is your Workspace slug. It appears in the keyring name tenant-{your-slug}-kms.

Rotate keys

Disable access

Audit every operation

Schedule destruction

​What Parable controls vs. what you control

​Your keyring

​Rotate

​Rotate content-encryption

​Disable

​Re-enable

​Destroy

​Audit logs

What Parable controls vs. what you control

Your keyring

Rotate

Rotate `content-encryption`

Disable

Re-enable

Destroy

Audit logs