Security and trust

What we do

• Infrastructure and network

  • All traffic goes through Cloudflare: DNS, content delivery, web application firewall and denial-of-service (DDoS) mitigation.
  • The origin server doesn't accept direct connections from the internet: the site reaches it through an outbound tunnel.
  • Connections always over HTTPS (TLS 1.2 or higher), with HSTS.
  • Hosting and database in Brazil.

• Data and encryption

  • Data encrypted in transit (HTTPS) and at rest in the managed database.
  • Passwords stored only as a strong hash; API keys stored only as hashes.
  • Integration credentials, such as payment accounts, encrypted in the database.
  • Each customer business sees only its own data: isolation between businesses is tested automatically.

• Access and operations

  • Administrative panels with restricted access and two-step verification.
  • Role-based access control and an audit trail of administrative actions.
  • The site accesses the database with a least-privilege user.
  • Attempt limits and automatic blocking of bots probing for known vulnerabilities.

• Secure development

  • Every change goes through type checking and automated tests before reaching production.
  • Automatic scanning for secrets in published code.
  • Separate staging and production environments; only numbered versions go to production.
  • The server refuses to start in production with a weak security configuration.

• Backups and continuity

  • Daily database backups, with restore tests.
  • Continuous monitoring and a public status page.
  • If a product is discontinued, we give advance notice and offer data export.

• Privacy (LGPD)

  • We collect the minimum necessary and explain every use in our Privacy Policy.
  • Data export and deletion available; data subject requests through the privacy channel.
  • In FinSight AI, personal data (tax IDs, email, phone, card) is masked before anything is sent to AI providers.
  • No advertising cookies; usage analytics only with consent, where applicable.