Information Security Policy
Version 1.0 · Effective from 10/14/2026
Courtesy translation. In case of discrepancy, the Portuguese version prevails (choose Português in the language selector at the bottom of the page).
This policy summarizes the technical and administrative measures Patentiq adopts to protect the platform's data (LGPD, art. 46). Details that could help an attack are not published.
1. Principles. Confidentiality, integrity and availability; least privilege; personal data kept to the minimum necessary.
2. Isolation between customers. Each customer can only access its own data. Isolation is enforced in the database itself, row by row, and tested automatically with every change to the system.
3. Access control.
- Access by invitation, with a personal password and recovery by email.
- Two-factor authentication available to all users and mandatory for the Patentiq team.
- Separate roles (customer administrator and regular user), with different permissions.
4. Encryption. All communication uses HTTPS. Data is encrypted at rest. Passwords are stored only in irreversible form. Sensitive domain registration data is sealed with AES-256-GCM, with keys kept outside the database.
5. Evidence integrity. Each piece of evidence receives an integrity code (SHA-256) and a timestamp from an independent authority (RFC 3161). Any later change becomes detectable.
6. Action log. Every action that changes data is recorded in a log that cannot be edited or deleted. Passwords, tokens and document numbers are not logged.
7. Secure development. Changes go through review and automated tests before release, including checks for secrets in the code, for dependencies with known vulnerabilities and for security headers. The database only changes through reviewed migrations. Test environments do not use real data.
8. Suppliers. We use well-known cloud providers, with the main data kept in Brazil. Suppliers are listed in the Privacy Policy.
9. Continuity. We maintain database backup and restoration procedures, tested periodically in a separate environment.
10. Incidents. Incidents are recorded, contained and analyzed. If an incident may cause relevant risk or harm to data subjects, we notify the ANPD and those affected within 3 business days (Resolution CD/ANPD No. 15/2024).
11. Vulnerability disclosure. Found a flaw? Write to clayton@patentiq.com.br. Do not take actions that affect third-party data or the availability of the service.
12. Review. This policy is reviewed with every relevant change to the platform and at least once a year.
Version history
| Version | Effective from | Change |
|---|---|---|
| 1.0 | 10/14/2026 | First published version. |