At Trace Case, we treat security as a priority to protect the confidentiality, integrity, and availability of data. Our practices align with the LGPD and industry standards.
1. Technical Controls
- Encryption: TLS in transit; encryption at rest when supported by the infrastructure.
- Access Management: least privilege, MFA for administrative accounts, environment segregation.
- Monitoring: audit logs, alerts, and continuous monitoring.
- Backups: periodic routines with restore testing.
- Secure Development: code review, vulnerability scanning, CI/CD pipeline checks.
2. Organizational Controls
- Policies: security, privacy, data classification, and incident response.
- Training: security and data-protection awareness for the team.
- Vendor Management: risk assessment and contractual data-protection clauses.
3. Incident Response
We follow identification, containment, eradication, recovery, and lessons-learned processes. For incidents with relevant risk to data subjects, we assess notice to authorities and individuals as required by the LGPD.
4. Continuity and Availability
We use redundant architecture where possible and run restore tests to reduce RTO/RPO according to the contracted service level.
5. Privacy by Default
We apply minimization, necessity, and proportionality. Whenever possible, we use aggregated/anonymized data for metrics and training internal AI models. We do not use data for unlawful purposes.
6. Requests and Reports
For security questions, email contato@trace-case.com. For personal-data requests (LGPD), contact the DPO: contato@trace-case.com.