Security

Information Security Policy

The umbrella of Paramétrica's security policies: what protects the traffic, the accounts, the passwords and the workstations — described from what the systems actually do.

Version 1.0 — effective September 1, 2026.

1. Scope and responsibility

This policy covers Paramétrica's systems — the administrative API, the customer portal, the administrative desktop application, this website and the automated services — and the team that operates them. Responsibility for the policy lies with management; the channel for security matters is administrativo@parametrica.com.br, and everything received there becomes a tracked ticket with a number and a queue.

2. Secure channel

  • All traffic is encrypted (HTTPS). Requests without a secure channel are refused — not redirected with the data inside.
  • No authentication ever travels in clear text.
  • Certificates renew automatically, with no human reminder involved.

3. Authentication and sessions

  • Individual authentication is mandatory before any data access.
  • Short sessions, renewed under control: the access credential expires in minutes, the session drops after inactivity and has an absolute duration cap — and can be revoked by the server at any moment.
  • Public routes — sign-up, access recovery — are rate-limited per origin.

4. Passwords

  • Passwords never exist in clear text on our servers. We store only an irreversible cryptographic derivation — not even our own team can read them.
  • There is a complexity floor, and no system route ever returns a password.
  • Access recovery always generates a new password; the old one is not recoverable.
  • We do not force periodic password changes, by design, in line with current NIST guidance (SP 800-63B): forced rotation produces predictable passwords. The real protection is strong derivation, rate limiting and immediate revocation.
  • The team's working credentials live in an encrypted password vault.

5. Workstations and servers

Antivirus and firewall active and auto-updating on every workstation and server; screens locked when away. System sessions expire on their own, regardless of the workstation.

6. Awareness

The team acknowledges this policy and its companions on hiring and at every revision. This policy records the obligation to maintain periodic awareness in information security and data protection.

7. Limits, stated plainly

No security measure is absolute, and we do not claim otherwise. Incidents have their own plan — the Incident Response Plan — and personal data handling, including incident notification to data subjects and the Brazilian DPA, is covered by the Privacy Policy.

8. Companion policies

Version 1.0 — September 1, 2026.