Data & Security Standards

The recognised data standards ParrotIt uses, and how your responders' information is kept secure — in plain English.

Last updated: 15 September 2026

Built to fit your systems

ParrotIt collects information using recognised data standards, so what you get out drops straight into your own systems — your responders answer once, and the data travels cleanly without re-typing.

• Dates as ISO 8601, phone numbers as international E.164, countries as ISO 3166 codes, emails validated to standard — automatically.
• Export machine-ready JSON / NDJSON with a data dictionary and JSON Schema, plus spreadsheet-safe CSV.

The standards we follow

• Dates & times — ISO 8601 / RFC 3339
• Phone numbers — E.164
• Countries — ISO 3166-1; currencies — ISO 4217; languages — BCP 47
• Email & web addresses — RFC 5321 / WHATWG URL
• Checksummed identifiers — NHS Number, IBAN, US routing number
• Interoperability — JSON Schema 2020-12, schema.org, JSON-LD

Secure by default

• End-to-end encrypted — responses are encrypted on the responder's device before they reach us; we can't read them.
• Tamper-evident audit trail — a submission's history is append-only and written by the server, and certification events carry cryptographic signatures.
• Clear control on both sides — organisations manage deletion and retention for their forms; the person who submitted can see who receives their data and can request deletion of a submission.

Companies we use

ParrotIt runs on other companies' services. Here is who they are, what each one does, and whether it can read what people put in your forms. Reviewed 15 September 2026.

• Google Cloud and Firebase. Hosting, database, file storage, sign in. Your data sits in London. It stores the locked answers, it cannot open them.
• Resend. Sends our email: notifications, reminders, welcome mail. Email addresses and message text only, never answers.
• OpenAI. Helps build forms and match field names. Answers are locked before they leave the device, so it never sees them.
• Stripe. Takes payment for paid plans. Billing details only.
• Sentry. Tells us when something crashes, and stores that in the United States. Anonymous crash data, no answers and no names.
• Google Analytics. Counts visits on our own pages, and only after you accept it. It never runs on the pages people fill forms in.
• World. Runs the human check, when you switch it on for a form. The selfie goes to World and never reaches us.
• Slack. Alerts our team when something breaks. Error messages only.

If you connect ParrotIt to Mailchimp or Zapier yourself, what you send them is your choice.

Procurement or a funder asking for the detail? The full sub-processor register has the contracting entity, country, and transfer terms for each one.

Standards alignment

Our controls align with ISO 27001 and UK GDPR Article 32 practices. ParrotIt provides the mechanism; the organisation collecting the data remains the data controller and owns its own compliance decisions.

Contact

For questions about data standards or security, contact ParrotIt via parrotit.app.