Security & privacy
Customer data is treated as a third-party asset.
Invoices, digital certificates and accounting records belong to the client of the contracting party. We treat that premise as an architectural constraint, not as a contract clause.
Technical controls
Tenant isolation
A dedicated database per customer. Tenant identity comes from the subdomain plus a validated token — never from the request body.
Encryption
Data encrypted at rest and in transit. Digital certificates and secrets in a managed vault, never in the repository.
Access control
Least privilege, named identities, and an audit trail of who accessed what and when.
Continuity
Managed backups with defined retention and tested restores. Environments separated by cloud project.
Supply chain
Dependencies pinned by version and updates reviewed before reaching production, both in the platform and on this site.
Data residency
Infrastructure in the provider’s Brazilian region, for latency and for the residency requirements around Brazilian tax data.
Brazilian data protection law (LGPD)
We act as a processor when handling personal data on behalf of a contracting customer, and as a controller of the contact details we receive through this site. We collect the minimum necessary, sell data to no one, and respond to access, correction and deletion requests.
| Data subject channel | amazoniabeats@gmail.com |
|---|---|
| Legal basis for contact data | Performance of a contract and legitimate interest in answering a commercial enquiry |