Your data, hosted in Europe and kept apart

Hosted in the European Union

The app, its API and its database run on Microsoft Azure, in the West Europe region (the Netherlands).

Only the interface files (code, images, translations), which hold no customer data, are distributed by the Microsoft content delivery network so that they load faster.

Each customer in its own compartment

Every record carries the identifier of the customer account. That identifier is read from the session verified by the server, never from a parameter sent by the browser.

On top of that, the PostgreSQL database enforces row-level security: a query only sees the data of the current account. Automated tests prove, on every code change, that one account can neither read nor modify another account's data.

Encrypted in transit and at rest

Everything goes over HTTPS, TLS 1.2 at least, with the HSTS header that forbids the browser to fall back to HTTP.

At rest, the database, its backups and the storage are encrypted by the Azure platform.

No database password

The app connects to the database with a Microsoft Entra managed identity: there is no database password at all, neither in the code nor in the configuration.

The remaining secrets, such as the session signing key, are kept in Azure Key Vault. The session cookie is signed, out of reach of the page's JavaScript and only sent over HTTPS.

Roles and least privilege

Two profiles in the app: employee and manager. Employees book and see their own reservations; only the manager sees the details of every reservation and manages spots and blocks. In the demo, anyone can switch profiles to try both.

On the infrastructure side, each component only has the rights it needs, granted on the resource concerned: the app does not own the database tables, and the automated deployment cannot assign any Azure role.

Minimal data in the demo

The demo asks for no account and no password. To personalise it, it asks for your company, first name, last name and professional email: the company and the name stay in your sandbox, deleted automatically after 24 h (at the latest within the following hour, then kept at most 7 days in the technical backups), and the email is only kept if you agree to be contacted (optional box, unticked by default).

Colleagues, plates and the car park address are fictional. Apart from the start form, please do not enter real data.

A site without trackers

parqube.com sets no cookies, uses no audience measurement and loads nothing from any other site. A strict content security policy (CSP) forbids any script or style that does not come from the site itself, as in the app.

The demo only sets one strictly necessary session cookie and keeps a few settings in your browser: the details are on the Cookies page.

Cookies and browser storage, for the site and for the demo

Telemetry without personal data

Errors and response times are tracked in Azure Application Insights, in West Europe, with alerts on error rate and latency, and kept for thirty days.

Telemetry leaves out cookies, request bodies and account identifiers in clear.

Backups

The database is backed up automatically. Backups are kept for seven days, in the same region.

Export of your data

The administrator downloads sites, spots, blocks, reservations, waiting lists, members and email settings as a single JSON document, or as one Excel-ready CSV file per entity, to archive them or switch tools.