INFORMATION SECURITY

01Purpose and scope

G. M. Cardoso Desenvolvimento de Sistemas Ltda. (Pedreiros de Bit, CNPJ 43.402.838/0001-14) protects the confidentiality, integrity and availability of all data it handles, including data from customers, end users and integrated third-party platforms.

This policy applies to all systems, applications, infrastructure and people that process data on behalf of Pedreiros de Bit. This includes our SaaS products, internal tools, development environments and any contractors working for the company.

02Roles and responsibilities

Guilherme Muniz Cardoso, founder and managing partner, is the Information Security Owner. The owner approves this policy, grants and revokes access, and leads incident response.

Any employee or contractor who joins the company must read and accept this policy before receiving access to production systems or customer data.

03Data classification and minimization

We classify data into three levels and protect each accordingly:

Third-party platform data. When a user connects an account from a third-party platform (for example, TikTok Shop) through OAuth, we:

• request only the API scopes required for the features the user actively uses;
• use the data solely to provide those features to the authorizing user;
• never sell, rent or share the data with other parties, and never use it for advertising or to train machine learning models;
• follow the platform's developer terms and data policies, which take precedence where stricter than this policy.

04Access control and authentication

• Least privilege: people and services receive only the access they need, and access is removed as soon as it is no longer needed.
• Multi-factor authentication (MFA) is mandatory on all company accounts: cloud providers, code repositories, domain registrar, email and developer portals.
• Unique accounts: credentials are never shared. Passwords are generated and stored in a password manager.
• Production access is limited to the Security Owner. Access to production databases is logged.
• User authentication: our applications authenticate users through OAuth 2.0 or a managed identity provider and never store third-party platform passwords.
• Access review: all accounts and permissions are reviewed at least every six months.

05Encryption and secret management

• In transit: all traffic to and from our applications and APIs uses TLS 1.2 or higher. Plain HTTP is redirected to HTTPS.
• At rest: databases, backups and file storage are encrypted using our cloud providers' managed encryption (AES-256).
• OAuth tokens are additionally encrypted at the application level before storage, and refresh tokens are rotated as supported by each platform.
• Secrets (API keys, app secrets, database credentials) are stored in environment variables or a managed secret store. They are never committed to source code, printed in logs or sent over chat or email.
• Rotation: a secret is rotated immediately if exposure is suspected, and whenever someone with access to it leaves the company.

06Secure development and infrastructure

• Separate environments: development, testing and production are isolated. Production data is never copied to development; testing uses sandbox or test accounts provided by each platform.
• Version control: all code lives in private repositories with protected main branches. Changes to production go through review before deployment.
• Dependencies are monitored with automated vulnerability scanning, and critical security updates are applied within 7 days.
• Secure coding: we validate all input, use parameterized database queries, protect against common web vulnerabilities (OWASP Top 10) and verify the signature of every incoming webhook.
• Logging and monitoring: applications log authentication events, errors and access to sensitive operations. Logs never contain tokens, secrets or full personal data, and are kept for 90 days.
• Backups: production databases are backed up daily, encrypted, and restoration is tested periodically.
• Devices: work computers use full-disk encryption, automatic screen lock and up-to-date operating systems.

07Network security

We do not operate physical networks or on-premise servers. Our infrastructure runs on managed cloud platforms under a shared responsibility model: providers secure the underlying network and hosts, and we secure our configuration, applications and data.

Network segregation

• Development, testing and production run in isolated environments with separate credentials, networks and databases.
• Production databases are not reachable from the public internet. They accept connections only from our application servers, through private networking or IP allowlists.
• Only HTTPS (port 443) is publicly exposed. All other inbound traffic is denied by default.

Intrusion detection and prevention

• All public traffic passes through an edge network with a Web Application Firewall (WAF), DDoS mitigation, bot protection and rate limiting, which detect and block malicious requests before they reach our applications.
• We use only cloud providers that run network and host-level intrusion detection on their infrastructure and hold SOC 2 or ISO 27001 certifications.
• Any self-managed server must run host-based intrusion prevention (such as CrowdSec or Fail2ban), allow SSH only with key-based authentication from allowlisted IPs, and receive security updates automatically.

Monitoring

• We monitor authentication events, error rates and anomalous traffic, with automated alerts sent to the Information Security Owner.
• Firewall and WAF rules are reviewed at least every six months and after any incident.

08Endpoint security and daily baseline

Every computer used for company work, including contractors' computers, must meet this baseline before accessing company systems or data:

• Endpoint protection: built-in antivirus and anti-malware with real-time scanning and automatic updates (macOS XProtect and Gatekeeper, or Microsoft Defender) is kept enabled.
• Updates: automatic installation of operating system, browser and security updates is enabled.
• Disk encryption: full-disk encryption (FileVault or BitLocker) is enabled.
• Screen lock: the screen locks automatically after 5 minutes of inactivity and requires a password to unlock. Users lock the screen whenever they step away.
• Passwords: passwords have at least 14 characters, are unique per service, and are generated and stored in a password manager.
• Multi-factor authentication is enabled on every account that supports it.
• Clean desk and clear screen: credentials and customer data are never written on paper, left visible on screen, or viewed or discussed in public spaces. Screens are not shared on calls while confidential data is visible.
• Lost or stolen devices are reported to the Information Security Owner immediately, and all sessions and credentials on the device are revoked.

09Vulnerability management

We identify and fix vulnerabilities through the following process:

• Detection: automated dependency scanning (GitHub Dependabot) runs on every repository. We also monitor security advisories from our cloud providers and from the platforms we integrate with.
• Prioritization: each vulnerability is rated by severity, using the CVSS score when available, and by whether it affects code or data in production.
• Remediation deadlines:

• Verification: fixes are tested and reviewed before deployment, and the vulnerability is confirmed as closed.
• Reporting: anyone can report a vulnerability to security@pedreirosdebit.com. Reports are acknowledged within 3 business days.

10Data retention, deletion and user rights

We comply with Brazil's General Data Protection Law (LGPD, Law No. 13,709/2018) and keep personal data only as long as needed for the purpose it was collected for.

• Disconnection: when a user revokes access or disconnects a third-party account, we stop all API calls immediately and delete the related tokens. Data obtained from that account is deleted within 30 days, unless a law requires us to keep it.
• Account deletion: users can request deletion of their account and data at any time. Requests are completed within 15 days.
• User rights: users can request access to, correction of, or a copy of their personal data by contacting privacy@pedreirosdebit.com.
• Backups containing deleted data expire through normal backup rotation within 35 days.

11Third-party vendors

We use established cloud providers for hosting, databases and email delivery. Before adopting a vendor that will process restricted or confidential data, we verify that it:

• encrypts data in transit and at rest;
• holds recognized security certifications (such as SOC 2 or ISO 27001) or publishes equivalent security documentation;
• offers data processing terms compatible with the LGPD.

We keep an internal list of vendors that process personal data and share it with platform partners on request.

12Incident response

A security incident is any event that compromises, or may compromise, the confidentiality, integrity or availability of data. The Security Owner handles every incident in five steps:

1. 1Contain: revoke exposed credentials and tokens, block suspicious access and isolate affected systems.
2. 2Assess: identify what data, users and platforms are affected.
3. 3Notify: inform affected users and the relevant platform partners (such as TikTok Shop) without undue delay, and within 72 hours of confirmation or sooner if the partner's terms require it. Where the LGPD requires, the Brazilian Data Protection Authority (ANPD) is also notified.
4. 4Fix: remove the root cause and restore normal operation.
5. 5Review: document the incident, its cause and the actions taken, and update this policy if needed.

Vulnerabilities or incidents can be reported to security@pedreirosdebit.com.

13Policy review and contact

The Security Owner reviews this policy at least once a year, and whenever there is a significant change in our products, infrastructure or applicable law. The current version is always published at https://pedreirosdebit.com/en/security.