Data Privacy and Information Security
1. INTRODUCTION
1.1. The Information Security Policy aims to create administrative, technical and physical safeguards, aiming to ensure the reliability, integrity and security of the information of the customer and the business of Attrus Instituição de Pagamento SA (or simply Attrus).
1.2. This Policy refers to the guidelines established for granting access, collection, distribution, process, protection, storage, use, transmission, elimination or other form of handling of Information.
1.3. At Attrus we understand that safety is a core part of the company's culture and DNA. We understand and believe in a "Security by Design" approach, where all business building is done on a solid foundation in security.
2. SCOPE
2.1. For the purposes of this Policy, all employees who have access to a certain Information and/or Attrus Information Asset are all employees.
3. RESPONSIBILITIES
3.1. All employees are responsible for maintaining the confidentiality of the information and, in this sense, must sign the "Term of Responsibility for Access to Confidential Information", expressly assuming the obligations described therein.
3.2. Third party companies (service providers) that have access to an Attrus system must be informed about the Principles and Guidelines related to Information Security before receiving any type of access.
3.3. The Attrus employee, responsible for hiring the outsourced company, will be responsible for disclosing the content of this policy to the service provider in order to ensure its compliance.
3.4. It is the responsibility of the Technology Management to define the policies, strategies and processes related to information security.
4. PRINCIPLES OF INFORMATION SECURITY
4.1. Attrus is committed to the proper treatment of its own, customer and third-party information, based on:
- Confidentiality: access to information is obtained only by authorized persons and only when it is necessary;
- Availability: information is available to authorised persons when needed;
- Integrity: the information is integral and accurate and its processing is compatible with the required quality.
5. INFORMATION SECURITY GUIDELINES
5.1. The information must be used in a transparent manner and only for the purpose for which it was collected.
5.2. Every process, during its life cycle, must ensure the segregation of duties, through the participation of more than one Employee or team of Employees.
5.3. Access to information and resources should only be made if duly authorized.
5.4. The identification of any Employee must be unique, personal and non-transferable, qualifying him or her as responsible for the actions performed.
5.5. The granting of access must comply with the criterion of least privilege, in which users have access only to the information resources essential for the full performance of their activities.
5.6. The password is used as an electronic signature and must be kept secret, and its sharing is prohibited.
5.7. Risks to the Institution's information must be reported to the Information Security Management.
5.8. Responsibilities regarding Information Security must be widely disclosed to Employees, who must understand and ensure these guidelines.
6. THE CLASSIFICATION OF INFORMATION
6.1. Its purpose is to define adequate levels and criteria for the protection of Information, ensuring confidentiality, integrity and availability. The classification given to Information is a way of determining how this information will be treated and protected throughout its life cycle
7. RISK MANAGEMENT
7.1. Risks must be identified through an established process for analyzing vulnerabilities, threats and impacts on the Institution's information assets, so that appropriate protections are recommended.
8. EVALUATION OF THE INTERNAL CONTROLS AND COMPLIANCE MANAGEMENT
8.1. The effectiveness of this Policy will be evaluated annually by the Internal Controls and Compliance Management and, when necessary, by an Audit company.
9. INFORMATION SECURITY COMMITTEE
9.1. It is the responsibility of the Information Security Committee, as applicable, the attributions granted in the Policy for the proposition of a Deliberative Committee.
9.2. The Committee will be composed of members from the Risks, Internal Controls and Compliance, Commercial and Information Technology areas.
9.3. The Information Security Committee may be established at any time, however, the minimum period of 3 (three) days for convening is respected.
9.4. Except for matters considered urgent, for which the Committee may meet at any time, including at a distance, by means of video conference.
9.5. The matters submitted to the Committee's deliberation must be recorded in the Minutes, which must contain the signature of all members.
10. INFORMATION SECURITY TRAINING
10.1. All employees receive initial training, refresher courses and educational materials for a perfect understanding of all items in this policy and their responsibilities in protecting the privacy of the Information.
11. INVESTIGATION OF INCIDENTS
11.1. The Information Technology Management and the Internal Controls and Compliance Management must be informed about any security incident, suspicion of unauthorized disclosure, detection of intrusion, leakage, misuse, alteration, destruction or other compromise to information security, as well as indications, ideas and hypotheses about computer crimes suffered by Attrus.
11.2. It is the responsibility of the Information Technology Management, together with the Internal Controls and Compliance Management, to verify and verify the facts presented, as well as to submit to the Information Security Committee indications or evidence that Attrus has been the victim of unauthorized disclosures, fraud, misuse, alteration, vandalism, destruction, breach of confidentiality or integrity of the "Information" or other compromise to security.
12. DISCIPLINARY MEASURES
12.1. Violations of this policy are subject to the disciplinary sanctions provided for in the internal rules and in the legislation in force in Brazil.
13. IMPLEMENTATION, CONTROL AND EXECUTION
13.1. The effective implementation, control and execution of this information security policy is carried out through the rules and technical standards defined in the IT Governance Manual.
14. PROCEDURES AND GUIDELINES FOR CYBERSECURITY
14.1. To protect the Attrus system, all applications used are protected by a Firewall, in addition to being constantly updated and protected by antivirus and anti-malware programs to detect and remove potential malicious software threats.
14.2. The exchange of access to common ports is also implemented, as a way to prevent possible intrusion, together with constant log analysis and error reporting to verify intrusion attempts.
14.3. Finally, access to sensitive protocols is limited through a specific IP (connected to the local network of the contracted software house), so that it is necessary to use a VPN to release specific people.
15. HANDLING OF SENSITIVE INFORMATION
15.1. The information obtained through the operation of Attrus is compartmentalized within a role-based tiering system, whereby each team within Attrus only has access to certain information based on what is necessary for the performance of its activity.
15.2. Classification of information:
15.2.1. Personal Data: Refers to all information related to identified or identifiable individuals, including, but not limited to, name, CPF/MF, address, telephone, e-mail, among others.
15.2.2. Financial Data: Comprises information about bank accounts, financial transactions, payment history, balance, among other sensitive data of a financial nature.
15.2.3. Payment Data: This includes information about payments made by Attrus' customers, including details about merchants, amounts, dates, and any data related to financial transactions.
15.2.4. Consumption Management Data: Refers to data used to control and monitor the consumption of Attrus users, such as information on purchases, consumption habits, preferences, among others.
15.2.5. Other Sensitive Information: Includes any other data that, by virtue of its nature, may cause damage to customers, Attrus or third parties if compromised.
16. ENCRYPTION AND DATA MASKING
16.1. In addition, encryption and masking is used to protect the confidentiality of data in transit and at rest, with the database being fully encrypted.
17. BACKUPS
17.1. There is also a backup system every 3 hours, with a retention of fifteen days, to mitigate losses in case of security incidents.
18. CONTINUITY PLAN
18.1. To ensure the continuity of operations, Attrus conducts, every two weeks or together with new versions, quality and infrastructure analysis tests. In addition, it has a data replication system and load balancer on servers, so that if one server goes down, a second server can take over the functions, avoiding the occurrence of overload as much as possible.
19. INCIDENT NOTIFICATION
19.1. Incidents received by Attrus must be recorded in an internal call system, being evaluated and resolved manually by the company's employees.
20. PROCEDURES AND REQUIREMENTS FOR CONTRACTING SERVICES
20.1. Attrus uses outsourced services and, to ensure the security of the operation and information, requires that its contractors have a secure and closed digital environment, always using VPN and encryption protection.
20.2. In addition, the information that circulates with the contractors must also be encrypted and, in the case of using an outsourced development team. PCI DSS Certification, where applicable, will be considered when hiring partners.
21. RESPONSIBILITIES
21.1. All stakeholders are responsible for complying with this policy. The information security department is responsible for monitoring and ensuring compliance with this policy.
22. COMPLIANCE AND REVIEW
22.1. This policy will be reviewed annually to ensure that it remains relevant and effective in the face of changing regulatory requirements and threat environments.