Security and Privacy

Security has been part of how Virio is built from the start. The person responsible for information security and data protection is the data protection officer named in the Privacy Policy (contato@virio.com.br).

Principles: least privilege, secure by default and verification before every release. Every change involving authentication, permissions, database, integrations or secrets goes through diagnosis and review before reaching production, with a documented rollback plan.

This policy is reviewed at least once a year and whenever the Platform changes in a relevant way.

• Database, authentication, file storage and server functions run on Supabase, on servers in Brazil (AWS, São Paulo); the website and web app are hosted by Lovable, without access to the database;
• Network isolation and protection against denial-of-service attacks are provided by these cloud providers;
• All traffic uses HTTPS (TLS 1.2 or higher);
• The database only accepts authenticated connections; public endpoints validate all input and are rate-limited; public forms use bot protection (Cloudflare Turnstile).

• Each workspace has roles (owner, admin, editor and viewer) enforced on the server; hiding a button is never treated as a permission;
• Row Level Security on every table: one workspace cannot see another's data;
• Service credentials stay on the server and never reach the browser;
• Administrative production access is restricted to the founder and recorded in an audit log;
• Company devices run up-to-date antivirus (Microsoft Defender).

• Integration credentials (access tokens of connected accounts): encrypted with AES-256-GCM before storage and never displayed;
• Virio customer data (account, content, metrics): encrypted in transit and at rest, isolated per workspace;
• Buyer data from connected stores and marketplaces: Virio does not store the buyer's name, document, e-mail, phone or address; when needed to avoid duplicates, it keeps only an irreversible code (hash);
• Technical logs: contain no personal data and no secrets.

• Security events (administrative access, permission changes, integration connections and disconnections) go to an immutable audit log;
• Operations are reviewed daily through an internal summary of failed automated jobs, payments and risks.

• Security reviews (code, database access rules and permissions, secrets) accompany every development stage;
• Dependency vulnerability alerts are monitored and fixed by severity, critical and high first;
• Secrets are never kept in source code; they live in the provider's secret store;
• Found a vulnerability? Write to contato@virio.com.br. We reply and handle reports with priority.

A security incident is any event that compromises the confidentiality, integrity or availability of data processed by Virio. The data protection officer leads the response in these steps:

• Identification: recording the alert or report and an initial assessment;
• Containment: blocking improper access, revoking affected credentials and preserving evidence;
• Assessment: which data, which customers and what risk to data subjects;
• Communication: notice to affected customers and data subjects and, when there is relevant risk or harm, to the Brazilian Data Protection Authority (ANPD), within the time and form required by the LGPD (art. 48) and ANPD rules; partner platforms (such as connected social networks and marketplaces) are notified when data received from them is affected;
• Remediation and learning: fixing the root cause, verification and a record of the incident and the measures taken.

To report an incident or a suspicion: contato@virio.com.br.

Platform data is stored in Brazil (São Paulo). Processors that handle data outside Brazil, and the safeguards adopted, are listed in the Privacy Policy (sections 7 and 12).

Retention periods for each type of data are in the Privacy Policy (section 9). When an account is disconnected, its access tokens are deleted immediately. To request deletion of your data: https://www.virio.com.br/data-deletion.

Virio does not yet hold a formal security certification (such as ISO 27001 or SOC 2). The controls described here follow article 46 of the LGPD.

Security, privacy and vulnerability reports: contato@virio.com.br.