Information security

• Hosting in a cloud environment in Brazil and Europe, outside shared hyperscale clusters;
• Traffic protected by Cloudflare (WAF, DDoS mitigation, TLS);
• Encryption in transit (TLS 1.3) and encryption at rest;
• Data isolation per organization (multi-tenant);
• Multi-factor authentication required for administrators;
• Secrets and credentials managed via Infisical (zero hardcoding);
• Audit logs retained for 12 months;
• Active responsible disclosure program via [email protected].

We operate in a cloud environment in Brazil and Europe, organized in Kubernetes clusters. We do not use shared hyperscale clouds. Incoming traffic is routed and filtered by Cloudflare (WAF, rate limiting, DDoS protection) before reaching our infrastructure.

Each customer's data is isolated per organization (multi-tenant), with no crossover between accounts. Hosts are immutable (containers), updated through a CI/CD pipeline with GitOps (ArgoCD). There is no direct SSH access to production by automated processes; all human intervention is logged.

• In transit: TLS 1.3 with modern cipher suites (AEAD). HSTS enabled. Certificate management via Cloudflare;
• At rest: database volumes and backups are encrypted;
• Secrets: Infisical as a centralized secrets vault, with access control per project and environment;
• Passwords: Bcrypt/Argon2id with a unique salt per credential.

We apply the principle of least privilege. Access to critical systems requires MFA. Provisioning and deprovisioning follow a formal flow. Permissions are reviewed periodically.

• Automatic infrastructure snapshots (configurable retention);
• Encrypted database backups, with periodic rotation;
• Disaster recovery plan that prioritizes critical services;
• Periodic restore tests.

Centralized telemetry via Grafana (dashboards), Prometheus (metrics) and Loki (logs). Alerts configured for performance and security anomalies. Application audit logs retained for 12 months; system logs, 6 months (Brazilian Civil Rights Framework for the Internet, art. 15).

Documented response plan, with defined roles (incident response, communication, legal, DPO) and priority classification of events. In incidents involving personal data, notification to the ANPD and to data subjects follows our LGPD policy.

All vendors that process personal data undergo a security and privacy review before being hired. Annual reassessment is mandatory for critical vendors.

Security researcher? Bring it on. We reward valid reports.

• E-mail: [email protected]
• Initial response: within 48 business hours