Information Security and Data Protection Policy

Version 1.0 · In force since October 3, 2026 · Reviewed yearly

This policy sets the information security and personal data protection rules of BETESDA TECNOLOGIA LTDA (CNPJ 30.903.973/0001-00) for ColibriERP. It applies to all employees, contractors and systems that process customer data. The Portuguese version prevails in case of discrepancy.

1. Responsibilities

• Management approves this policy and provides the resources to comply with it.
• The Data Protection Officer (DPO) coordinates information security and privacy: developer@colibrierp.com.br.
• Every team member protects the credentials and data they can access and reports any incident immediately.

2. Data classification

• Public: website content and marketing materials.
• Internal: technical documentation and operational information.
• Confidential: customer and store data, personal data, marketplace API access tokens, credentials and backups.

Confidential data may only be processed in production systems with restricted access, and may not be copied to personal devices or shared beyond the purpose of the service.

3. Access control

• Access is granted on least-privilege and need-to-know principles.
• In the application, each client company accesses only its own data; user roles (owner, member, platform administrator) limit the allowed actions.
• Administrative access to servers is restricted to authorized technical staff, with strong authentication.
• Administrative accounts (hosting, email, marketplace accounts, code repository) use two-factor authentication where available.
• Access is reviewed quarterly and removed immediately when no longer needed.

4. Endpoint security

• Company computers have automatic screen lock, strong passwords, up-to-date operating systems and active malware protection (for example macOS built-in protection or Microsoft Defender).
• Clean desk: documents and screens with confidential data are not left unattended.
• Passwords are unique per service and kept in a password manager.

5. Network and infrastructure security

• Production servers expose only the necessary services (HTTPS and administrative access).
• The database runs on a private network with no direct internet access.
• All communication with the application and with marketplace APIs is encrypted with TLS.
• Access and operation logs are kept for monitoring and investigation.

6. Encryption and backups

• Data in transit: TLS on every connection.
• User passwords: stored only as cryptographic hashes.
• API access tokens and backups: stored encrypted.
• Daily database backups, with limited retention and restricted access.

7. Vulnerability management

• Operating system security updates are applied automatically.
• Software dependencies are reviewed monthly; critical flaws are fixed within 7 days and high ones within 30 days.
• Every code change passes automated tests before reaching production.

8. Incident response

• Anyone who identifies a possible incident reports it immediately to the DPO at developer@colibrierp.com.br.
• The DPO coordinates containment, investigation and remediation, and records the incident and lessons learned.
• Affected customers and partner platforms (including TikTok Shop) are notified within 72 hours of confirming an incident involving personal data; the ANPD and data subjects are informed when required by the LGPD.

9. Personal data protection

• Processing follows the LGPD and our Privacy Policy, only to provide the service to the customer who authorized access.
• Requests from data subjects and customers (access, correction, deletion, portability) are handled within 15 days, including those forwarded by marketplaces.
• When the contract or authorization ends, the customer's data is deleted or anonymized within 30 days, unless the law requires retention.
• Data is stored and processed in Brazil.

10. Review

This policy is reviewed at least once a year or when the service or the law changes significantly.