Information Security

1. Our approach

We follow market best practices inspired by recognized industry references, such as the ISO 27001 family and NIST 800-53, and security by design principles, with security considered from the conception of each feature, not as a layer added afterwards.

Tangerin AI is a growing company. We do not claim to hold our own formal certifications (such as ISO 27001 or SOC 2) at this time. When we obtain them, we will publish them here. The infrastructure subprocessors we use (Section 9) hold their own certifications, which cover their infrastructure, not the operation of Tangerin AI.

2. Access management and authentication

• Multi-tenant isolation through Row Level Security (RLS) in the database: each organization can only access its own data, enforced at the database level, not only in the application.
• Agent authentication by an API key exclusive to each organization, rotatable at any time by the administrator.
• Principle of least privilege for internal access by Tangerin AI staff to customer data, restricted to those who need it to provide support or maintenance.
• Audit log of all administrative actions performed on the platform, with author, action and time.

3. Encryption

• In transit: all communication between the agent, the web dashboard and the API takes place over HTTPS/TLS 1.2 or higher.
• At rest: data stored in encrypted form in the database infrastructure.
• Passwords: never stored in plain text; managed with hashing (bcrypt) by the authentication provider.
• Payments: take place on pages hosted by Asaas and Stripe; card data does not pass through our servers.

4. Network and infrastructure security

The platform is hosted on managed infrastructure (Vercel for the web application/CDN, Supabase for the database and authentication), which provides network isolation, DDoS protection at the edge and continuous updating of the underlying systems. We do not operate our own physical servers.

5. Security in the development lifecycle

• Type checking, automated tests and lint block the integration of code with known problems before any production deploy.
• Code review of relevant changes before publication.
• We maintain an internal record of identified vulnerabilities (internal or reported by third parties) and their remediation history.
• Development and production environments are segregated; production credentials are not used in a test environment.

6. Business continuity and disaster recovery

We use infrastructure providers with their own availability and disaster recovery guarantees. The database has an automatic backup routine managed by the subprocessor, allowing restoration in the event of data loss. We have not yet published a formal RTO/RPO. It is an item on our security maturity roadmap.

7. Security incident response

In the event of a security incident involving customer data, Tangerin AI notifies the contracting organization within 72 hours of becoming aware of the incident, as detailed on the LGPD page.

Suspect an incident or a vulnerability? Write to seguranca@tangerinai.com.

8. Responsible vulnerability disclosure

If you are a security researcher and have identified a vulnerability in our systems, we have a dedicated channel and process: see our Responsible Vulnerability Disclosure Policy.

9. Subprocessors and third-party certifications

We use the following subprocessors essential to the operation of the service:

If we add new essential subprocessors, we will notify the administrators of the contracting organizations at least 15 days in advance, as also described in our Privacy Policy.

10. Contact