diff --git a/src/Entity/Paragraph.php b/src/Entity/Paragraph.php
index 2f8a012..c6fe132 100644
--- a/src/Entity/Paragraph.php
+++ b/src/Entity/Paragraph.php
@@ -82,6 +82,13 @@ class Paragraph extends ContentEntityBase implements ParagraphInterface {
   /**
    * {@inheritdoc}
    */
+  public function getParentEntity() {
+    return \Drupal::entityManager()->getStorage($this->get('parent_type')->value)->load($this->get('parent_id')->value);
+  }
+
+  /**
+   * {@inheritdoc}
+   */
   public function preSave(EntityStorageInterface $storage) {
     parent::preSave($storage);
 
diff --git a/src/ParagraphAccessControlHandler.php b/src/ParagraphAccessControlHandler.php
index c4eb862..3a82cee 100644
--- a/src/ParagraphAccessControlHandler.php
+++ b/src/ParagraphAccessControlHandler.php
@@ -22,9 +22,15 @@ class ParagraphAccessControlHandler extends EntityAccessControlHandler {
   /**
    * {@inheritdoc}
    */
-  protected function checkAccess(EntityInterface $entity, $operation, AccountInterface $account) {
+  protected function checkAccess(EntityInterface $paragraph, $operation, AccountInterface $account) {
     // Allowed when the operation is not view or the status is true.
-    return AccessResult::allowedIf($operation != 'view' || $entity->status->value);
+    /** @var \Drupal\paragraphs\Entity\Paragraph $paragraph */
+    if (!$paragraph->isNew()) {
+      $parent_access = $paragraph->getParentEntity()->access($operation, $account, TRUE);
+      return AccessResult::allowedIf($operation != 'view' || $paragraph->status->value)
+        ->andIf($parent_access);
+    }
+    return AccessResult::allowedIf($operation != 'view' || $paragraph->status->value);
   }
 
   /**
diff --git a/src/ParagraphInterface.php b/src/ParagraphInterface.php
index e9bf06b..c5f80a6 100644
--- a/src/ParagraphInterface.php
+++ b/src/ParagraphInterface.php
@@ -13,10 +13,14 @@ use Drupal\Core\Entity\ContentEntityInterface;
 
 /**
  * Provides an interface defining a paragraphs entity.
- * @ingroup account
+ * @ingroup paragraphs
  */
 interface ParagraphInterface extends ContentEntityInterface, EntityChangedInterface, EntityOwnerInterface
 {
 
-  // Add get/set methods for your configuration properties here.
+  /**
+   * Gets the parent entity of the paragraph.
+   *
+   */
+  public function getParentEntity();
 }
diff --git a/src/Tests/ParagraphsAccessTest.php b/src/Tests/ParagraphsAccessTest.php
new file mode 100644
index 0000000..c47090d
--- /dev/null
+++ b/src/Tests/ParagraphsAccessTest.php
@@ -0,0 +1,125 @@
+<?php
+/**
+ * @file
+ * Contains \Drupal\paragraphs\ParagraphsAccessTest.
+ */
+
+namespace Drupal\paragraphs\Tests;
+
+use Drupal\Core\Entity\Entity;
+use Drupal\field_ui\Tests\FieldUiTestTrait;
+use Drupal\simpletest\WebTestBase;
+use Drupal\user\RoleInterface;
+use Drupal\user\Entity\Role;
+
+/**
+ * Tests the security of paragraphs.
+ *
+ * @group paragraphs
+ */
+class ParagraphsAccessTest extends WebTestBase {
+
+  use FieldUiTestTrait;
+
+  /**
+   * Modules to enable.
+   *
+   * @var array
+   */
+  public static $modules = array(
+    'node',
+    'paragraphs',
+    'field',
+    'image',
+    'field_ui',
+    'block',
+    'paragraphs_demo',
+  );
+
+  /**
+   * {@inheritdoc}
+   */
+  protected function setUp() {
+    parent::setUp();
+    $this->drupalPlaceBlock('local_tasks_block');
+    $this->drupalPlaceBlock('page_title_block');
+  }
+
+  /**
+   * Tests the paragraph translation.
+   */
+  public function testParagraphTranslation() {
+    $admin_user = $this->drupalCreateUser(array(
+      'administer site configuration',
+      'administer nodes',
+      'administer content types',
+      'administer node fields',
+      'administer node display',
+      'administer paragraphs types',
+      'administer paragraph fields',
+      'administer paragraph display',
+      'administer paragraph form display',
+      'administer node form display',
+      'create paragraphed_content_demo content',
+      'edit any paragraphed_content_demo content',
+      'delete any paragraphed_content_demo content',
+    ));
+    $this->drupalLogin($admin_user);
+
+    $this->drupalLogin($admin_user);
+
+    // Remove the "access content" for anonymous users. That results in
+    // anonymous users not being able to "view" the host entity.
+    /* @var Role $role */
+    $role = \Drupal::entityManager()
+      ->getStorage('user_role')
+      ->load(RoleInterface::ANONYMOUS_ID);
+    $role->revokePermission('access content');
+    $role->save();
+
+    // Set field_images from demo to private file storage.
+    $edit = array(
+      'settings[uri_scheme]' => 'private',
+    );
+    $this->drupalPostForm('admin/structure/paragraphs_type/images/fields/paragraph.images.field_images_demo/storage', $edit, t('Save field settings'));
+
+    // Create a new demo node.
+    $this->drupalGet('node/add/paragraphed_content_demo');
+
+    // Add a new paragraphs images item.
+    $this->drupalPostForm(NULL, NULL, t('Add Images'));
+
+    // Create a file, upload it.
+    $text = 'Trust me I\'m an image';
+    file_put_contents('temporary://privateImage.jpg', $text);
+    $file_path = $this->container->get('file_system')
+      ->realpath('temporary://privateImage.jpg');
+
+    $edit = array(
+      'title[0][value]' => 'Security test node',
+      'files[field_paragraphs_demo_0_subform_field_images_demo_0][]' => $file_path,
+    );
+    $this->drupalPostForm(NULL, $edit, t('Save and publish'));
+
+    $node = $this->drupalGetNodeByTitle('Security test node');
+    $image_url = file_create_url('private://privateImage.jpg');
+
+    $this->drupalGet('node/' . $node->id());
+
+    // Check the text and image after publish.
+    $this->assertRaw($image_url, 'Image was found in content');
+
+    $this->drupalGet($image_url);
+    $this->assertResponse(200, 'Image could be downloaded');
+
+    // Logout to become anonymous.
+    $this->drupalLogout();
+
+    // Check the text and image after publish.
+    // Anonymous should not see content.
+    $this->assertNoRaw($image_url, 'Image was not found in content');
+
+    $this->drupalGet($image_url);
+    $this->assertResponse(403, 'Image could not be downloaded');
+  }
+}