Information Security Policy

The platform runs on a major cloud infrastructure provider. Environments are defined and deployed as code, reviewed before changes are applied, and provisioned through a repeatable, auditable pipeline rather than manual configuration.

Customer data is logically isolated by workspace at the database layer. Application code paths enforce workspace scoping on every read and write of business data.

Sign-in, session lifecycle, and multi-factor authentication are delegated to a dedicated identity and access management provider. Internal access to production infrastructure follows least-privilege principles and is granted per role, not by default.

Traffic to the platform is encrypted in transit. Data at rest is stored using our cloud provider's managed database and storage services, which encrypt data at rest by default.

Attachments uploaded by users are stored in access-restricted object storage, partitioned by workspace, and made available only through short-lived signed URLs — never through public, permanent links.

Deletions of operational records are logged and reversible through a recovery mechanism rather than immediate, silent removal. A scheduled routine reconciles expired or failed background operations.

AI-assisted features call the model provider exclusively from server-side code. Provider credentials are never exposed in client-side code or to the browser.

Suspected security incidents should be reported to privacy@peoplebcp.com. We investigate promptly and, where personal data is affected, follow the notification process described in our LGPD Policy.

This policy describes engineering practices as implemented at the time of publication. It is not a compliance certification (such as ISO 27001 or SOC 2); we will update this page if that scope changes.