Privacy Policy

INDENE SECURITY LTDA, Brazilian corporate taxpayer number (CNPJ) 69.303.454/0001-38, with its registered office at R. Ana Neri, 145, Vila Metalúrgica, Santo André/SP, CEP 09220-030, Brazil, is the controller of the data it processes in its own name, described in this policy, under art. 5, VI, of Brazilian Law No. 13,709/2018 (the General Personal Data Protection Law, LGPD). For the data that a client organization enters into the product, we act as processor, as the section on our role explains.

For any question about this policy, or to exercise the rights described in the data subject rights section, write to dpo@indene.io. The role of Data Protection Officer (DPO, LGPD art. 41) is performed by the Indene privacy team, which answers through this channel within the deadlines of this policy. Commercial contact: contato@indene.io.

Two distinct environments, with distinct processing:

• This website (indene.io): public, institutional pages, with no sign-up. Processing here is limited to browsing metrics and whatever you send us by e-mail or through the site form.
• The Indene platform (the product): an authenticated environment contracted by client organizations, with the data categories described in the following sections.

• As controller: website data, commercial contacts, account and security data of those who use the platform (registration, login, sessions, access trail) and billing data.
• As processor: the data that the client organization enters into the product (evidence, assessments, process data and any personal data in them). We process this content under the contract and the client's instructions, only to provide the contracted service. The client is the controller and answers to data subjects for that content.

• Browsing metrics: we use OpenPanel, an analytics tool operated on our own infrastructure (analytics.indene.io), cookie-free and with no cross-site tracking. It records navigation events (page viewed, language) under an anonymous identifier generated by the analytics server and kept only in the page's memory, writing nothing to your browser. Like any server, it receives the IP address and user agent of the request. We build no individual profile and sell no data to third parties. The tool's script is downloaded from openpanel.dev, which also receives the IP and user agent of the download; no browsing event is sent to that domain.
• Infrastructure records: the site is served by Cloudflare, which keeps edge logs (IP address, user agent) for security and attack mitigation, plus aggregate performance metrics (Cloudflare Web Analytics, cookie-free). The home page picks the language from the country Cloudflare resolves from your IP and from your browser language; Indene does not store that information.
• Contact: if you write to us or fill in the site form (name, e-mail, company and the interest you indicate), we process that data to reply and follow up commercially. Form data is recorded in our CRM, with the page it was sent from and, when there is one, the campaign that brought the visit.

The site's typefaces are served from our own domain: no connection is made to third-party font servers while you browse.

In the product, we work with these categories of data:

• Registration and account: name, corporate e-mail, access profile, linked organization and, if you upload it, a profile photo. Login uses a one-time access code sent by e-mail; no password is stored. If you turn on the second factor, we store its secret, encrypted, and the recovery codes.
• Security and platform usage: audit trail (who changed what, when), IP address and browser of each login and session, a record of the e-mails the product sends, notification and language preferences and the active organization.
• Conversations with Aegis (AI): the sessions and the AI usage log. They may contain personal data that you type, so avoid writing what is not needed.
• Data entered by the client organization: control evidence (including uploaded documents, PDFs and images), maturity assessments, business process data and risk quantification that the organization itself registers or imports. This set is confidential to the client organization, and we act as processor, not controller, over it (art. 5, VII, LGPD). Where it contains personal data of that organization's staff, the controller is that organization.

Each processing purpose rests on a legal basis under art. 7 of the LGPD:

• Performance of a contract: operating the account and the product contracted by the client organization.
• Compliance with a legal or regulatory obligation: retention of audit trail and evidence required by Central Bank of Brazil rules (e.g. CMN Resolution No. 4,893/2021 on cyber security policy for financial institutions).
• Legitimate interest: security of the site and the platform, fraud prevention, aggregate site browsing metrics and product improvement based on account and usage data, never on the content entered by the client organization, always subject to a proportionality assessment and without prejudice to the data subject's rights.
• Consent: today we use no non-essential cookies. If we ever do, or start sending marketing communications, we will ask for your consent first (see the Cookie Policy).

The product uses language models to suggest evidence classification, propose quantifications and answer questions. The AI suggests: no model output changes a score, a number or a report without a person's acceptance, and every suggestion accepted, edited or refused stays on the trail, with author and date.

Calls go through a single access point, are logged and ask the provider not to retain the content or use it to train models. AI providers act as additional processors of Indene. You may ask for human review of any result that affects you (LGPD art. 20).

Data may be shared with:

• Infrastructure providers (hosting, database, transactional e-mail, artificial intelligence, self-hosted analytics), always under a data processing agreement and confidentiality clauses. The list of subprocessors, with the purpose and country of each, is in the Trust Center.
• Regulatory and judicial authorities, when required by law, court order or a supervisory body's request (e.g. the Central Bank of Brazil).
• The client organization itself, within the limits of each user's access profile; never across distinct client organizations.

Isolation between organizations is enforced in the database (row-level security), not just in the application. Exceptions are few, named, minimal in surface and covered by tests.

The site is distributed through Cloudflare's global network, and the platform's infrastructure providers, including the artificial intelligence ones, may process data outside Brazil. The country of each provider is in the Trust Center subprocessor list. When an international transfer takes place, it follows one of the mechanisms of art. 33 of the LGPD (standard contractual clauses, adequacy decision or the data subject's specific consent, as applicable) and is declared with the provider, the country and the mechanism used.

Account data is kept for as long as the client organization's contract lasts. Audit trail and evidence have a minimum retention set by the regulation applicable to the client's sector (typically 5 years for financial institution records). Commercial contact messages are kept for as long as needed to handle them. Once the relationship ends and the legal retention period expires, data is deleted or anonymized, subject to the cases of art. 16 of the LGPD.

Technical and organizational controls applied today:

• On this website: served exclusively over HTTPS with HSTS, a strict Content Security Policy (CSP) that lists each allowed origin, and protection headers against clickjacking and content sniffing.
• On the platform: per-organization isolation enforced by database row-level security; an immutable audit trail for every change to a score, evidence item or control status; passwordless authentication (one-time code valid for 10 minutes), with an optional authenticator-app second factor; lockout for 15 minutes after 5 wrong attempts; sessions of at most 7 days and up to 3 simultaneous sessions; an e-mail alert on every new sign-in; connector credentials encrypted at rest; encryption in transit (TLS) on all communication.

No system is infallible. Security incidents affecting personal data will be reported to the ANPD (Brazilian data protection authority) and to affected data subjects within the deadlines of art. 48 of the LGPD and ANPD regulations. When we act as processor, we will notify the client organization so it can meet its own deadlines.

Under art. 18 of the LGPD, the data subject may request, at any time:

• Confirmation that processing exists, and access to the data;
• Correction of incomplete, inaccurate or outdated data;
• Anonymization, blocking or deletion of unnecessary data or data processed in violation of the law;
• Portability of the data to another service provider;
• Deletion of data processed on the basis of consent;
• Information on the public and private entities the data was shared with;
• Information on the option of refusing consent and its consequences;
• Withdrawal of consent, where that is the legal basis;
• Objection to processing carried out without consent, where the law is not being complied with;
• Review of a decision made solely on the basis of automated processing (art. 20).

The data subject may also file a petition with the ANPD against the processing of their data. To request any of these rights, write to dpo@indene.io; for your security, we may ask for information that confirms your identity. We answer requests within 15 days.

If your data is held by a client organization of Indene, that organization is responsible for it. We will forward the request to it and help it to fulfil the request.

The site and the product are intended for corporate (B2B) use by adults at client organizations. We do not knowingly collect data from anyone under 18.

This policy may be updated to reflect legal, regulatory or operational changes. The date and version at the top of this page always indicate the version in force; material changes will be communicated by e-mail to client organization administrators.

Items marked as targets are part of the product compliance roadmap and have not yet been obtained; no certification is claimed as completed in this version of the document.