One base. Each in its own row.
The database itself separates each company, row by row. Encrypted personal data, an audit trail, two-factor authentication and data in São Paulo complete the foundation.
Four facts you can check.
Controls already working in the platform, which you see in the demo, one by one.
Row-level isolation
Each company isolated from the others, row by row, by the database itself: a query sees only the rows of the company that asks.
Encrypted personal data
Whatever identifies a person is encrypted by the application, field by field, before it is stored.
Audit trail
Every audit record carries a SHA-256 hash to check whether it was altered.
Data in Brazil
Data hosted in Brazil, in São Paulo, under the LGPD, Brazil’s data-protection law.
Who gets in, and what they can do.
Every sign-in goes through a strong password and two factors, and every action through the role of whoever performs it.
Two factors
Two-factor authentication, backup codes and session revocation.
Passwords
Passwords of at least 14 characters and lockout after failed attempts.
Roles
Role-based permissions, checked on the server: without the right role, the request is refused before it reaches the data.
Four-eyes approval
Payments under four-eyes approval: whoever prepares one cannot approve it, and the approver confirms with a fresh authentication.
LGPD by design.
The data subject’s rights become requests with a deadline, and every processing activity has its record and its legal basis.
Read this site’s privacy policyData-subject requests
Every data-subject request with the LGPD’s 15-day deadline running from the request, with the requester’s identity verified before the answer.
Incidents
A security incident with the 3-business-day deadline to notify the ANPD, counted without weekends or national holidays.
Record of processing
Every processing activity with its legal basis, retention and status.
Consents
Every consent given or withdrawn goes into a hash-chained ledger, each record linked to the one before.
Kept out of events
CPF, CNPJ, phone, Pix key and address stay out of events between products.
Sensitive metrics
Sensitive people metrics only show for groups of 10 or more, so no one can be recognized within the group.
Responsible disclosure.
Found a vulnerability? Tell us before you tell anyone else. We work with you until it is fixed.
Where to write
security@nexuslume.ai
The security contact is published at /.well-known/security.txt, under RFC 9116.
The e-mail channel opens soon: until then, this address does not receive messages. Prepare your report with the steps below and keep the vulnerability confidential; when the channel opens, the address becomes a link on this page.
See the security.txt fileDescribe the vulnerability
What it affects, the steps to reproduce it and the impact you observed.
Test with care
Don’t access, change or delete data that isn’t yours, and don’t degrade the service.
Keep it confidential
Don’t disclose the vulnerability until it is fixed and we have agreed on how to make it public.
We respond
We confirm receipt, keep you informed until the fix and, if you wish, give you credit.
This covers this site and the Nexus Lume platform. Social engineering, denial of service and physical testing are out of scope.
Questions about security
Does each company get a database of its own?
No. They all live in the same database, and the database itself isolates each company, row by row: a query sees only the rows of the company that asks.
Where is the data kept?
In São Paulo, Brazil. A replica in Vinhedo, in São Paulo state, is planned and not yet live.
Does Nexus Lume display certification seals?
No. We show the controls working in the platform itself, during the demo: isolation, encryption, the audit trail, two-factor authentication and four-eyes approval.
Does this site use cookies?
No. This site sets no cookies and loads nothing from third parties. A few display choices, such as dismissing the language suggestion, are kept only while the tab is open.
One whole company. One system.
See each control working, in the platform, with Grupo Vértice’s data.