What we put in a contract, and the seals we do not have.
This page answers the questionnaire before you send it. Two systems have two different answers: the public site is running, the product platform is not. Where a field is somebody else’s decision or a measurement nobody here has taken, it is left blank and named rather than filled with a guess.
This page is not finished. Every bracket below marks a field that is somebody else’s decision, or a measurement nobody here has taken yet. It stays out of the search index until the last one is closed, because a guess that looks like data is worse than a declared hole.
Does your client’s code leave our infrastructure?
This is the first question a security questionnaire asks, and the one that decides the deal. The honest answer today is that nobody here has measured it end to end, so it is not answered on this page.
Unanswered. Not "no" — unanswered.
Two systems, two different answers
The public site is running. The product platform is not. Mixing the two is how a trust page stops being true.
The public site
Runs on Vercel with the database on Supabase. It stores the email address of anyone who subscribes to the bulletin, and the bulletin articles themselves. Hosting region: [CONFIRMAR: região de hospedagem do site e do banco]
The product platform
Not live. Infrastructure is being rebuilt, so there is no client environment today and no client data inside one. What it will store: [CONFIRMAR: o que a plataforma armazena do ambiente do cliente — código-fonte, achados, credenciais, artefatos]
Encryption
HTTPS across the whole site, with no plaintext endpoint. At rest: [CONFIRMAR: provedor, algoritmo e quem detém a chave]
Retention
[CONFIRMAR: prazo de retenção por tipo de dado, e o que acontece com ele no fim do contrato]
Access
[CONFIRMAR: quem alcança dado de cliente, sob qual controle, e se o acesso é registrado]
Who else touches the data
This is the list for the public site. The product platform list is not complete, and an incomplete list is worse than none.
| Vendor | What it processes | Region |
|---|---|---|
| Vercel | Hosting and delivery of the public site, plus request logs | [CONFIRMAR] |
| Supabase | Site database: bulletin articles and subscriber email | [CONFIRMAR] |
| Anthropic | Drafts bulletin copy from public sources. Receives no client data | [CONFIRMAR] |
| Resend | Transactional and bulletin email delivery; subscriber email | [CONFIRMAR] |
[CONFIRMAR: lista completa de subprocessadores da plataforma de produto]
The seal we do not have, traded for terms you can enforce
A certificate is one way to buy assurance. A contractual obligation with a number and a penalty behind it is another, and it is the one available today.
Right to audit
You, or an auditor you hire, audit our environment and our controls. [CONFIRMAR: escopo, frequência e prazo de aviso da auditoria]
Incident notification within a committed window
The number goes in the contract with a penalty behind it. [CONFIRMAR: prazo de notificação de incidente, e a multa]
Exit without penalty
Termination for convenience, with no exit fee and no charge for the remaining term. [CONFIRMAR: prazo de aviso prévio]
Data portability
Findings, reports and history in an open format, during the contract and not only at the end of it. [CONFIRMAR: formato e prazo de entrega]
Said plainly, because you would ask anyway
Two phrases you will not find on this page: "in the process of certification" and "aligned with ISO 27001". The first is false without an open process. The second is what every CISO reads as "we do not have it".
No ISO/IEC 27001 in our own name
And no certification process open. If there were one, a Stage 1 would exist and we would name its date.
No SOC 2, neither Type I nor Type II
There is no independent auditor report to attach to your questionnaire.
No SLA and no availability figure
The platform is not live. An uptime number would be a number about nothing.
No claim of data residency in Brazil
Nobody here has measured the region. The field above is blank for that reason.
Send us your security questionnaire and we will answer it, including the blanks.
The answers that are not on this page yet get answered as unmeasured, not as compliant.