Security and privacy

Certifications

We do not hold a certification of our own yet (such as SOC 2 or ISO 27001). We run a security and privacy management system built on those standards, with written policies, a risk register, drills and periodic reviews. Our main providers publish their own certifications.

Where the data lives

The application and the database run in São Paulo, Brazil. To write replies, messages go through Anthropic, in the USA.

Each business kept apart

Every request to the server checks which business the user belongs to. Automated tests prove that one business cannot see another's data, and the database is closed to everything except our server; a daily check verifies it.

Encryption

Everything travels encrypted (HTTPS). The database is encrypted by the provider. Each business's keys (for example, for its booking system) are stored encrypted with AES-256. Files sent by a guest only open through links that expire within minutes.

Access

Each business's team signs in with mandatory two-step verification and role-based permissions. Important actions are kept in an audit log that cannot be modified.

Backups and continuity

Encrypted backup every day and an automatic restore test every month. If the main AI model does not respond, the assistant tries another one; if nothing works, it tells the person and our team.

Artificial intelligence

We use the Anthropic API, which does not train its models on this data and deletes it after 30 days (except cases flagged for abuse). We do not use AI providers that train on customer data. The assistant never confirms a payment on its own: a person checks it.

Privacy

We comply with Brazil's LGPD and with the GDPR where it applies. We keep only what is needed: conversations are anonymized after 12 months without activity (each business can change this), check-in documents are deleted after 30 days, and we never store ID numbers. Anyone can ask for their data to be deleted across all channels.

Secure development

Every change goes through automated tests and security checks: packages with known vulnerabilities, accidentally exposed keys, and the database configuration.

Report a vulnerability

If you find a security issue, write to privacy@itconnected.us. We reply within 3 business days. We take no legal action against anyone who reports in good faith without accessing other people's data or disrupting the service.

Providers that process data (subprocessors)