What Parakh Actually Sees
Parakh is a browser and an on-device scanner. That defines its limits precisely, and the limits are worth stating before the capabilities.
It can see
- Links, messages and pictures you choose to check, including through another app's share sheet
- Pages loaded inside Parakh itself, including whether a page is asking for a password
- QR codes you scan with it
- Apps installed on the phone, their permissions and their known vulnerabilities
- Whether each phone's protections are switched on
It cannot see
- Conversations and messages you have not chosen to share with Parakh
- Pages inside another app's built-in browser
- Anything typed outside Parakh
- Your contacts, calls or precise location, or photos you have not selected for a check
- Payments started inside a banking or payment app
How MAGI Checks, And What Leaves Your Phone
MAGI is MagenSec's security AI. In Parakh it reads a link, a page, a message or a screenshot the way a sharp friend would: who it claims to be, what it wants from you (money, an OTP, a login or an app install), how hard it pushes, and whether it matches a scam campaign already caught. Look-alike names and hidden redirects are evidence MAGI shows you, not the whole judgement.
| On your phone | MAGI does its first read here. On-device AI recognises when a page looks like a sign-in, payment or banking screen, reads the words in a picture (Latin and Devanagari scripts) and translates them. Most checks finish on the phone, with or without an account. |
|---|---|
| Screenshots | The picture stays on your phone and is deleted after the check. Only the words and links MAGI reads from it may be sent for a second look. |
| A second opinion on a link | Parakh sends the link, stripped of its query string, fragment and any username or password. Links that identify a person or a session, such as password resets, sign-in, payment and chat links, are refused rather than sent. A shortened link can be followed on our servers, so the scam site sees MagenSec, not your phone. |
| A message you ask about | Sent only when you ask MAGI to check it and accept the consent sheet. Web addresses in the text are replaced with [link] first. To read the page behind the riskiest link, Parakh sends that one link as written and our servers open it, so the page never loads on your phone. The text is analysed automatically and is not kept as text. |
| Protected Preview | Shows a risky page inside Parakh's own isolated browser view on your phone and clears that session when you leave. |
| Guardian alerts | Tell your person what kind of risk it was and, sometimes, the website's name. Never what a message said. |
| Installed apps | Checked on your phone for risky permissions and known vulnerabilities. The list is not sent to us. |
No person reads your everyday checks
Link, page and message checks are automated end to end. Nobody at MagenSec reads them, and the support view described below does not show them. If you choose to send us a report, you are sharing it with our security team so they can look into it.
Caught once, recognised faster
When MAGI confirms a scam, it remembers the campaign, not who saw it. That memory carries no account, device or Circle, and it expires: a scam message pattern within 180 days of first being seen, a scam page within a year. Safe messages are never added.
Two Asks, And When Parakh Is Awake
Parakh asks you for two things, and each has one job.
| Notifications | So a warning, or a call for help from someone you look after, reaches the right person in time rather than after. |
|---|---|
| Default browser (Android) | So MAGI checks a link before it opens. You keep your favourite browser: links that pass the check open there, and risky ones stay in Parakh's protected view. |
Android also grants two permissions at install, without a prompt: internet access, and the ability to list installed apps for the on-phone app check above.
When Parakh is awake
Parakh does not read your messages, notifications, screen or clipboard. MAGI steps in when a link opens through Parakh, or when you ask it to check something. Apart from that, it does only these small things:
- A short status about once a day while you use Parakh, and sooner after your plan or Circle changes. It is the device information listed in the privacy policy, never browsing.
- Checking in for someone you watch over. About every 15 minutes, less often at night, a guardian's phone asks whether there is an alert. On a phone that watches over no one, this scheduled wake-up ends on the phone.
- Delivering an alert that missed its moment. If a phone was offline when MAGI stopped a serious threat, the alert to its guardian is retried until it arrives.
- Work Circle notices. While Parakh is running on a Work Circle phone, it looks for new notices from the circle at most every 15 minutes.
Everything else your Circle sends arrives through your phone's standard notification service, so Parakh does not need to keep asking.
What An Administrator Can See
A Work Circle owner or co-admin sees posture, never content. This is the whole list, and it is worth showing your team before they install anything.
| Whether each phone is protected | Yes visible |
|---|---|
| What needs fixing, and how to fix it | Yes visible |
| When a phone last checked in | Yes visible |
| Total links checked and threats stopped | Yes, as a circle total visible |
| Risky sites that reached the circle | The site's name and how many phones met it, never which phones. In a very small circle, a site that reached one phone can still point to one person. visible |
| Which sites a person visited | Never not collected |
| Which links a specific person opened | Never not collected |
| Anything typed, messaged or photographed | Never not collected |
| Location | Never not collected |
Per-device link volume is deliberately withheld even from administrators. "This phone checked 847 links" reads as surveillance and would contradict the promise the product is sold on.
And What They Can Send
An administrator can post one notice to the circle, and can send a reminder about one thing that needs fixing — "links are skipping Parakh", "your app needs updating". Both arrive as a notification on the phone.
They cannot write the reminder. It is one of nine fixed sentences, each about the recipient's own phone, each with a button that opens the screen that fixes it. Nothing an administrator types reaches anybody's lock screen through Parakh. A reminder about one problem can go out once every four hours, the same phone hears about the same problem at most once a day and about anything at most every 90 minutes, and the whole circle is capped at twenty reminders a day.
Where It Runs, And What Is Stored
| Service | Delivered from a global edge network, so there is no single server to breach and no regional outage that takes everyone down. |
|---|---|
| Link checking | Cloud checking is on by default once you sign in. It can be switched off on any device; on-device checking carries on. |
| On-device data | Link history and page content stay on the phone. They are never uploaded, and our staff cannot read them. |
| Account data | Sign-in identity, devices, licences and protection counters. Nothing about browsing. |
| Backups | The Android app disables OS-level app backup on purpose, so the local database is never copied off the device by the platform. |
| Deletion | Self-service and irreversible from the account page. It removes the account, profile, devices, owned circles, licences and credits. |
Access By Our Support Team
Authorised staff can open a read-only support view of an account to diagnose a problem. That access is:
- Read-only. It writes nothing and changes nothing.
- Logged. Every view records who looked, at what, and when.
- Limited. It shows the same account and device information the customer sees.
- Carved out. It does not include on-device link history or the contents of any page.
This is stated in the privacy policy, not only here.
Standards And Frameworks
Stated plainly, because a vague answer here is worse than a modest one.
| India DPDP Act 2023 | Parakh is built to support a business acting as a data fiduciary: data minimisation, purpose limitation, self-service deletion, and a security-controls record you can produce on request from the Business Console. |
|---|---|
| Security attestation | Available to Work Circle administrators. It is a record of the controls Parakh observes on enrolled phones. It is not a certification or an audit, and it does not claim to be. |
| ISO 27001 / SOC 2 | Not certified today. We will say so plainly rather than imply otherwise. |
| SSO / SAML | Not available today. Sign-in is Google identity. On the roadmap, ungated by any technical blocker. |
| SCIM provisioning | Not available today. Seats are managed by invite code or QR. |
| MDM / UEM integration | Not available, and deliberately so. Parakh is built to be deployable by a business that has no MDM at all. |
| SIEM / SOC feed | Not available today. Administrators can export device posture as CSV, and an audit log of account actions is retained. |
Reporting A Vulnerability
If you believe you have found a security issue, write to security@MagenSec.app. Please include enough detail to reproduce it. We will acknowledge, investigate, and tell you what we found.
Do not test against other people's accounts or data. We will not pursue good-faith research that respects that line.
Who We Are
| Company | XenoCraft Labs Pvt. Ltd., Hyderabad, India |
|---|---|
| Product | Parakh by MagenSec |
| Support | support@MagenSec.app |
| Security | security@MagenSec.app |