Information Security Policy

TokPilot Digital Strategy · Brazilian MEI · Tax ID (CNPJ) 60.750.422/0001-06 · Version 1.1 · Last updated: September 21, 2026

This Policy sets out the principles, controls, and responsibilities TokPilot applies to protect the confidentiality, integrity, and availability of its own information and that of its customers and partners. It is part of our Information Security Program and is reviewed periodically. It applies to all employees, contractors, systems, devices, and data under our responsibility.

1. Governance and responsibilities

Information security is sponsored by company management and coordinated by the Information Security Officer, a role held by José Wellington Coelho Graça, who also serves as Data Protection Officer (DPO). All employees and contractors are responsible for complying with this Policy. Deviations are handled according to severity and may lead to corrective measures. Security and privacy contact: contact@tokpilot.com.br.

2. Security baseline for daily operations

The organization maintains a mandatory baseline of day-to-day controls applied to all terminals and corporate accounts:

Multi-factor authentication (MFA) is used on critical services that provide it, including infrastructure, email, code repositories, payment, and administrative providers.
Password strength and hygiene: strong passwords (minimum 12 characters mixing upper/lowercase, numbers, and symbols), mandatory use of a password manager, no reuse and no sharing. End-user passwords are stored only in an irreversible form (bcrypt hash).
Automatic screen lock after a short idle period (up to 5 minutes), requiring a credential to unlock.
Clean desk and clear screen policy: sensitive information and credentials are never left visible or unattended; documents are stored or securely disposed of.
Endpoint protection: we maintain malware protection, security updates, and monitoring compatible with the assets in use, and review the safeguards periodically.
Patching: automatic updates of operating systems and applications; full-disk encryption enabled on workstations.
Awareness: staff receive periodic guidance on phishing, social engineering, and security best practices.

3. Access control and least privilege

We maintain an access control policy based on the principles of least privilege and need-to-know. Access to systems and personal data is granted strictly according to each person's role.

Role-based access control (RBAC) and separation of duties.
Access to personal data is restricted to the minimum necessary. Internal and administrative areas (e.g., the product's admin panel) require elevated privileges and are limited to a controlled list of authorized administrators.
Individual, named accounts; credential sharing is prohibited.
Periodic review of granted access and immediate revocation upon termination or role change.
Privileged access requires MFA; relevant actions are recorded in audit trails.

4. Data classification and encryption

We adopt a four-tier information classification policy — Public, Internal, Confidential, and Restricted — with personal data, credentials, and secrets treated as Restricted and subject to the strictest controls.

Encryption in transit: all traffic uses TLS 1.2+ (HTTPS) with managed, auto-renewing certificates (Let's Encrypt) and forced HTTPS redirection.
Encryption at rest: databases and volumes are protected; passwords use bcrypt hashing; secrets and API keys live in access-restricted environment variables (files with limited permissions, never in source code).
Payment data: we do not store card numbers. Stripe processes card payments and subscriptions, and Asaas processes Pix credit payments; we receive only the transaction confirmations and metadata necessary for the payment.
Key management and periodic rotation of keys and secrets; secure retention and disposal per LGPD.

5. Network security and segregation

The infrastructure is protected in multiple layers and applies network segregation:

Environment segregation: production, staging, and administration are isolated. Databases and internal services are not exposed to the internet — access occurs only over the internal/private network between services.
Firewall with restrictive rules (only strictly necessary ports, such as 443/HTTPS) and a reverse proxy with automatic HTTPS at the edge.
Administrative access via SSH exclusively with a cryptographic key (no passwords), on a non-standard port, with fail2ban and trusted-IP allowlists.
Traffic monitoring, workload isolation, and a minimal-attack-surface principle.

6. Incident response

We maintain an incident response policy with defined roles and responsibilities and clear communication channels. The Information Security Officer acts as the response lead.

Response cycle: detection and triage → containment → eradication → recovery → post-incident analysis (lessons learned) and continuous improvement.
Reporting channel: security incidents and suspicions must be reported immediately to contact@tokpilot.com.br, which routes them to the Information Security Officer.
Notification: in the event of a breach involving personal data, we notify the competent data protection authority and affected data subjects within the legal timeframes (LGPD/GDPR), as well as partners and authorities where applicable.
All incidents are logged, documented, and tracked to closure.

7. Vulnerability and threat management

We run a continuous vulnerability and threat management procedure, prioritized by severity:

Continuous monitoring and scanning of systems and software dependencies, with automatic alerts for known vulnerabilities (CVE).
Patch management: fixes are assessed and applied promptly, prioritizing critical/urgent items by severity (CVSS reference).
Dependencies: automated update and vulnerability checks of third-party libraries; controlled, reproducible builds.
Responsible disclosure: researchers and third parties may report vulnerabilities to contact@tokpilot.com.br; reports are handled confidentially.
Code review, periodic security testing, and monitoring of security logs and events.

8. Secure development

We apply secure development practices: code review, keeping secrets out of source code, least privilege in integrations, isolated environments, and controlled deployment processes.

9. Third parties and sub-processors

We carefully select our vendors and share only the minimum data necessary, under contract and confidentiality obligations. Key sub-processors include Stripe (payments, PCI-DSS), hosting and infrastructure providers, an email delivery provider, and AI providers. We continuously assess third-party security posture.

10. Business continuity and backups

We perform regular backups of critical data, with persistent volumes and restore testing, along with recovery plans to reduce downtime in case of failure.

11. Compliance

Our practices align with Brazil's LGPD (Law 13.709/2018), the GDPR, and the CCPA/CPRA. Personal data processing is detailed in our Privacy Policy.

12. Review and contact

This Policy is reviewed at least annually or whenever there are relevant changes in technology, processes, or regulation. Questions, requests, or incident reports: contact@tokpilot.com.br.