Trust is built through transparency.
Meet the practices, controls and people who look after your data at Cademí.
Documents
- Cookie Policy How Cademí uses cookies and other automatic data collection tools, and how to manage them in your browser.
- Privacy Policy - GDPR How Cademí collects, uses, stores and protects personal data under the European Union's General Data Protection Regulation (EU) 2016/679 (GDPR).
- Privacy Policy - LGPD How Cademí processes, shares and protects personal data, and the rights of data subjects, under Brazil's General Data Protection Law (LGPD), Law No. 13,709/2018.
- Software License Agreement Rules governing the provision of services and the license to use the Cademí platform: purpose, support, obligations, payment, term, personal data and jurisdiction.
- Terms of Use General terms governing the use of the Cademí platform: registration, responsibilities, content, intellectual property and governing law.
Our subprocessors.
- Linode (Akamai) Cloud hosting — servers and database · United States
- Cloudflare CDN, WAF, DDoS protection and DNS · Global (edge)
- Wasabi Object storage — backups and files · United States
- Twilio SendGrid Transactional email delivery · United States
- Sentry Error and performance monitoring · United States
- GitHub Code repository and CI/CD · United States
- Anthropic Artificial intelligence models (Claude) · United States
Access control
Policies and technical controls ensure that only authorized, verified people can access systems and sensitive data.
- Mandatory multi-factor authentication (MFA) (Monitored)
- Role-based access control (RBAC)
- Single sign-on (SSO) for internal systems
- Just-in-time privileged access
- Periodic access reviews (Monitored)
- Account lockout and session expiration
Data security
Customer data is encrypted, segregated and handled in accordance with the LGPD throughout its lifecycle.
- Encryption at rest (AES-256) (Monitored)
- Encryption in transit (TLS 1.2+) (Monitored)
- Logical per-customer data segregation
- Automated, tested backups
- LGPD-compliant retention and disposal
- Data masking outside production
Product security
Security is built into the development lifecycle, from design through deployment.
- Mandatory code review
- Static application security testing (SAST) in CI (Monitored)
- Dependency and vulnerability scanning (Monitored)
- Periodic penetration testing (pentest)
- Vulnerability management process
- Segregated environments (dev / staging / production)
Infrastructure and network
Our infrastructure runs in the cloud with network isolation, continuous monitoring and high availability.
- Network isolation (VPC) and firewalls (Monitored)
- WAF and DDoS protection (Monitored)
- 24/7 monitoring and alerting (Monitored)
- Server and container hardening
- High availability and disaster recovery
- Centralized logging
Governance and corporate security
Formal policies, training and clearly defined responsibilities underpin our security culture.
- Formal, reviewed security policies
- Employee security awareness training
- Pre-employment background checks
- Annual risk management
- Non-disclosure agreements (NDA)
- Defined organizational structure and roles
Incident response
Defined processes to detect, respond to and learn from security incidents.
- Documented incident response plan
- Incident detection and triage (Monitored)
- Post-incident root cause analysis
- Notification to data subjects and the ANPD under the LGPD
- Vulnerability disclosure program