POLICY · VERSION 1.0
Information Security Policy
1. Purpose
This Policy sets out the commitments and guidelines of NESS Processos e Tecnologia Ltda. for protecting its own information and the information it receives from clients, partners and individuals, in line with business risks, the law and its contracts.
This is the public version of the Policy. NESS practices are aligned with the requirements of ISO/IEC 27001:2022, in particular control 5.1 (policies for information security), of ISO/IEC 27002, which guides the implementation of controls, and of ISO/IEC 27701, which covers privacy management. Internal standards and procedures detail how each guideline is applied.
2. Scope
The Policy applies to the three NESS brands: ness., trustness. and forense.io. It covers everyone acting on behalf of NESS, such as partners, employees, interns and third parties; all information, in any format or medium; systems, services, equipment and environments, whether owned or contracted, including cloud; and suppliers that process information belonging to NESS or its clients.
3. Principles
Confidentiality: information is accessed only by those who are authorized and need it.
Integrity: information is accurate and complete, and is changed only by authorized people, in a traceable way.
Availability: information and systems are accessible to those who need them, when they need them, as agreed.
Privacy: personal data is processed for a defined purpose, only to the extent necessary, transparently to the data subject and in compliance with the LGPD (Brazil's General Data Protection Law, Law No. 13,709/2018).
Security is risk-based: controls are proportional to the importance of the information and the threats it faces.
4. Roles and responsibilities
Board of Directors: approves this Policy, sets the risk appetite, provides the necessary resources and periodically reviews information security performance.
Information security lead: coordinates risk management, proposes standards and controls, leads incident response, monitors compliance with this Policy and reports to the Board of Directors.
Managers: apply the Policy in their areas, authorize and review their teams' access, and make sure the people they manage know their responsibilities.
Employees and interns: comply with this Policy and the standards that detail it, protect the information they have access to, and report any incident or suspicion immediately.
Third parties: meet the security and privacy obligations set out in their contracts and in this Policy, to the extent they apply to the service provided.
5. Information classification
All information is classified according to its value, its sensitivity and legal and contractual requirements, and is protected according to its classification throughout its life cycle, from creation to disposal. Client information and personal data are handled, at a minimum, as confidential information.
6. Access control
Access to information and systems follows the principles of least privilege and need to know. Each access is individual, formally authorized and removed when no longer needed, including on a change of role and on termination.
Multi-factor authentication is mandatory for access to corporate systems, client environments and accounts with administrative privileges, wherever the technology allows it. Privileged accounts are restricted and their use is controlled. Access rights are reviewed periodically by the responsible managers.
7. Asset management
NESS keeps an inventory of its information assets, with a defined owner for each one. Assets are used according to the acceptable use rules, returned at the end of employment or contract, and disposed of securely, with the data they hold erased.
8. Cryptography
NESS uses encryption to protect confidential information in transit and, depending on classification and risk, at rest. Cryptographic keys are generated, stored, rotated and revoked in a controlled way, with restricted access.
9. Secure development
Systems developed or contracted by NESS follow a secure software development life cycle (SSDLC): security and privacy requirements from the start, code review, security testing before release to production, separation of development, test and production environments, and no real client or personal data in development and test environments. Secrets, such as passwords and keys, are never kept in source code.
10. Vulnerability management
NESS continuously identifies, assesses and remediates technical vulnerabilities in its systems, prioritized by risk. Security updates are applied within time frames that match their criticality, and exceptions are recorded and approved.
11. Logging and monitoring
Security-relevant events, such as access, privilege changes and failures, are logged, protected against tampering and kept for the period set by internal standards and by law. Logs are monitored to detect abnormal activity and support incident investigation.
12. Backup and continuity
NESS keeps backups of the necessary information and systems, protected and periodically tested for restoration. Continuity plans define how critical services are maintained or restored in the event of disruption, and are tested and reviewed periodically.
13. Incident management
Anyone who identifies an information security incident or suspected incident must report it immediately through the channel defined in internal standards, or to the information security lead. Clients, partners and the public can report incidents and vulnerabilities through the contact channels on the website.
Incidents are recorded, classified, contained, investigated and handled until resolved, with evidence preserved. When an incident affects clients or data subjects, NESS notifies them, and notifies Brazil's National Data Protection Authority (ANPD) and other authorities when required by law or contract. Lessons learned feed into the improvement of controls.
14. Suppliers
Suppliers that process information belonging to NESS or its clients are assessed for security and privacy before they are hired, in proportion to the risk. Contracts include confidentiality, data protection and incident notification obligations, and compliance with those obligations is monitored throughout the relationship.
15. Awareness and training
Everyone acting on behalf of NESS is briefed on this Policy when they join and takes part in periodic information security and privacy awareness and training activities suited to their roles.
16. Physical security
Locations that hold NESS information or equipment have controlled access and protection that matches the risk. Equipment used off-site, including for remote work, is protected against loss, theft and unauthorized access. Desks and screens must be kept clear of confidential information when unattended.
17. Acceptable use
NESS resources, such as computers, cell phones, accounts, email and systems, are used for work, ethically and in accordance with internal standards. It is forbidden to install unauthorized software, bypass security controls, share credentials or use resources for unlawful activities or activities contrary to the Code of Ethics and Conduct. NESS may monitor the use of its resources, within the limits of the law.
18. Use of artificial intelligence
Artificial intelligence tools are used only when NESS has approved them for the intended purpose. It is forbidden to enter client confidential information, personal data or internal information into any tool that has not been approved. Every decision that affects clients, individuals or NESS itself is made by a person, who reviews the tool's output before using it and is accountable for it.
19. Compliance and sanctions
NESS complies with applicable law, such as the LGPD and Brazil's Internet Civil Framework (Marco Civil da Internet), and with its contractual security and privacy obligations. Compliance with this Policy is checked periodically, including through internal audits.
A breach of this Policy exposes the person responsible to disciplinary measures proportional to its seriousness, under the Code of Ethics and Conduct and the law, and, for third parties, to the measures set out in their contracts.
20. Review
This Policy is reviewed at least once a year, or sooner if there is a significant change in the business, risks, technology or law. Revisions are approved by the Board of Directors.
Version 1.0, effective as of October 11, 2026.