Documented security

Clear controls for trusted digital relationships.

This center contains only protections implemented and information published in the current project. Certifications, external audits, or compliance levels are not declared without a validated record.

Implemented controls

Protections applied to the site and administration.

The controls below are verifiable in the project's code and automated tests.

Transport and browser

HTTPS with HSTS, content policy, frame blocking, content-type protection, and restrictive permissions policies.

Public submissions

Form submissions and audience collection reject requests without a valid origin or from another domain.

Administrative area

Access uses authenticated identity and permissions separated by module and operation type.

Data and audit

Relevant administrative actions are logged, sensitive deletions require reinforced confirmation, and operational records use soft deletion where provided.

Consent-based metrics

First-party collection depends on consent and does not store IP addresses, typed text, or form content.

Continuous validation

The build checks routes, migrations, request origin, security headers, metadata, and error behavior.

Limits of this statement

This page does not replace an independent audit report and does not assign controls that have not been evidenced.

No security certification is declared in this version.
No external penetration test is presented as completed.
The described coverage is limited to the current site and the administrative modules published in this project.

Vulnerability disclosure

A responsible channel for reporting issues.

Good-faith reports should allow safe reproduction without exposing personal data, disrupting services, or increasing the identified impact.

Describe

Provide the affected route, observed behavior, possible impact, and minimum reproduction steps.

Protect

Do not include credentials, résumés, contacts, personal data, or information obtained from third parties.

Submit

Use Talk to our team, select Cloud, DevOps, and Security, then choose Security and compliance.

Wait for triage

The record will be reviewed and routed internally. No public response time is guaranteed in this version.

Good-faith research

Do not interrupt, degrade, or overload the service.
Do not access, modify, copy, or delete other people's data.
Do not use social engineering, phishing, or attempts against third parties.
Stop testing when exposure risk or operational impact is identified.

Report a vulnerability

Due diligence materials

Documents organized for review.

The set below centralizes institutional information, public policies, and operational evidence available in the current project.

Institutional information

Legal name, Brazilian company ID, address, structure, and published representatives.

Open material

Privacy and cookies

Purposes, legal bases, retention, rights, and channels related to personal data.

Open material

Accessibility

Navigation, contrast, language, and text adjustment resources available on the site.

Open material

Terms of use

Conditions applicable to public pages, content, and features.

Open material

Published credentials

Leadership and service profiles available under explicit validation criteria.

Open material

Security policy

Implemented controls, statement boundaries, and the vulnerability process.

Open material

Documentation status

Publication without unsupported claims.

Partners, certifications, and external evidence will remain outside these materials until their records are approved.