Information Security

Security should protect the confidentiality, integrity and availability of information, taking into account the nature of the service and each operation's risks. These guidelines apply to the website and our relationships with clients and partners; controls for contracted systems, sensors and automation platforms must be included in each project's documentation.

• Limit access to information according to each person's needs and responsibilities.
• Protect credentials and review permissions when a role changes or a relationship ends.
• Consider security risks when selecting providers and developing solutions.
• Prioritize fixes and guide users on responsible use and information protection.
• Define continuity, backup and response procedures according to the environment and contracted scope.

Do not send passwords, access keys or confidential files through public forms. When sharing information for support, confirm the recipient and limit the data to what is necessary. Use the channels agreed in the contract for remote access or sending project files.

If you identify a possible incident or vulnerability, write to contato@carbontree.com.br with the subject “Information security — Carbontree”. Describe the affected service, date, perceived impact and a safe way to contact you.

Do not exploit the vulnerability beyond what is necessary to identify it, access other people's data or publish information that increases the risk. The report should allow an assessment and identification of appropriate measures, including legally required notifications where applicable.