INFORMATION SECURITY, INCIDENT AND VULNERABILITY MANAGEMENT POLICY

1. Purpose

This Policy sets out METADAX's public commitments to protect information, systems, applications, services, personal data and client assets against unauthorized access, destruction, loss, alteration, unavailability, improper disclosure and use incompatible with their purpose.

The Policy uses language proportionate to the size, structure, scale and volume of each service, the nature of the data involved and the risk it carries. Additional requirements for availability, continuity, auditing, encryption, support, monitoring or security may be defined in a contract, Data Processing Agreement, security annex or SLA.

This Policy does not disclose detailed architecture, internal detection rules, keys, credentials, configurations or information that could increase security risks.

2. Scope

Depending on the context, it applies to:

• websites, portals, applications and APIs operated by METADAX;

• SaaS products and licensed software;

• development, test and production environments;

• personal data and Client data processed by METADAX;

• employees, administrators, contractors, suppliers and partners with authorized access;

• development of websites, systems, automations, integrations and applications; and

• receipt, analysis of and response to vulnerabilities and incidents.

Third-party systems, data and environments that are not controlled or operated by METADAX are subject to the policies of their respective owners. The specific contract may define the applicable scope, responsibilities and controls.

Third-party websites developed by METADAX are the responsibility of those third parties. METADAX will not be held liable for errors, lost profits, losses or any other problems arising from intermittent access, total or partial unavailability, or loss or alteration of data.

3. Principles

METADAX's security is guided by the following principles:

4. Governance and responsibilities

METADAX's management is responsible for approving guidelines, allocating resources in proportion to risk and overseeing the response to relevant incidents.

The security officer or designated team coordinates the application of this Policy, vulnerability management, risk analysis, event response and internal communication. The privacy officer or Data Protection Officer (DPO) takes part whenever personal data, data subject rights or the need to notify the ANPD (Brazilian Data Protection Authority) are involved.

Employees, contractors and suppliers must:

1. use only authorized access;

2. protect credentials, keys, devices and information;

3. report suspicions, incidents and vulnerabilities;

4. follow training, procedures and instructions;

5. not copy, extract or share data without authorization; and

6. return, delete or restrict information when access ends.

Clients must use the services in accordance with the documentation, keep their credentials secure, apply controls in their own environments, provide emergency contacts and not enter high-risk data into a service that was not contracted for that purpose.

5. Security controls

Depending on the risk and the service, METADAX may adopt the following:

5.1 Access management

Access must be granted according to role, need and duration. Where possible, strong authentication, separation of privileges, periodic review, access logging and revocation when access ends or the need changes will be used.

Credentials must not be shared or stored in insecure places. Keys, tokens, passwords and secrets must be protected and replaced whenever compromise is suspected.

5.2 Development and changes

Solutions and changes must consider security from the planning stage. Depending on the risk, the process may include requirements review, environment segregation, version control, validation, testing, dependency analysis, access review and a rollback plan.

The level of testing and review will be proportionate to the service. Nothing in this Policy constitutes a certification, an independent audit or a guarantee that there are no vulnerabilities.

5.3 Updates and vulnerabilities

METADAX seeks to keep systems, dependencies and components on supported versions. Fix priority takes into account criticality, exposure, exploitability, impact, availability of a fix and service dependencies.

Identified vulnerabilities may be fixed, mitigated, monitored or temporarily accepted, with records and justification commensurate with the risk.

5.4 Data protection and encryption

Personal data and confidential information will be handled with measures appropriate to their nature and risk. Encryption, pseudonymization, masking, copy control and environment separation may be applied where technically and economically appropriate.

METADAX does not claim that all data, environments, backups, integrations or channels use the same encryption mechanism. Specific requirements will be defined in the service or the security annex.

5.5 Backups and continuity

When the service includes storage or hosting, METADAX may keep backups, redundancy or restore procedures according to the plan, the service and the risk. The Client must keep an independent copy of its data where this is consistent with its responsibilities and the contract.

RTO, RPO, availability, maintenance windows and continuity plans are only enforceable when expressly contracted. Having a backup does not guarantee that all content can be recovered, especially when the Client alters, deletes or fails to provide the necessary data.

5.6 Suppliers

Critical suppliers will be assessed according to their role, access, data, risk, criticality and cost. Contracts may include confidentiality, security, subcontracting, incident, deletion, audit or cooperation clauses, as applicable.

5.7 Physical and device security

METADAX will take reasonable measures to protect the offices, devices, equipment and media under its responsibility. The level of protection may vary for remote work, contractors, cloud environments, suppliers or third-party infrastructure.

6. Information classification

Information may be classified according to its sensitivity and impact:

Classification must consider the content and not just where it is stored. The Client may set stricter classifications or requirements in the contract.

7. Events, vulnerabilities and incidents

7.1 Vulnerability

A vulnerability is a weakness that could allow unauthorized access, alteration, unavailability, exposure or other impact. The existence of a vulnerability does not mean that it has been exploited or that an incident involving personal data has occurred.

7.2 Security event

An event is an observed or suspected occurrence that may affect security, such as an access attempt, alert, failure, outage, malicious code, anomalous behavior or a report from a third party.

7.3 Security incident

An incident is a confirmed event that compromises or may compromise the confidentiality, integrity, availability or authenticity of information or a system. A personal data incident is one that involves the processing or exposure of personal data.

7.4 Reportable incident

METADAX will assess whether an incident involving personal data may result in relevant risk or harm to data subjects. The assessment will consider the nature and category of the data, the number and profile of data subjects, the consequences, the ease of misuse, protective measures, extent, reversibility and other factors set out in the law and internal procedures.

8. Incident response and CSIRT

METADAX will maintain a designated officer, team or supplier to coordinate incident response. The process may include:

1. receipt and logging;

2. triage and classification;

3. containment and preservation of evidence;

4. investigation and impact assessment;

5. internal and contractual communication;

6. remediation, recovery and follow-up;

7. communication to regulators and data subjects where applicable; and

8. lessons learned and improvement of controls.

METADAX may restrict access to information about an incident to protect the investigation, security, privacy, trade secrets and instructions from authorities. Public or contractual communications must report confirmed facts, relevant risks, measures taken and useful guidance, avoiding speculation.

When METADAX acts as a processor, it will notify the controller client in accordance with the contract and provide reasonable cooperation for the assessment and legally required communications. The client remains responsible for the decisions and communications that fall to it as controller, unless the contract provides otherwise.

When the law and ANPD regulations require notification to the ANPD and to data subjects, METADAX will make or support the notification within the applicable deadline. ANPD Board Resolution No. 15/2024 sets, as a general rule, three business days and, where applicable to small processing agents under the regulations, double that time; METADAX does not use this information as a contractual incident SLA or as an exemption from a timely response.

9. Incident logging and retention

METADAX will keep a record of incidents and notification decisions, including incidents that were not notified, when required by regulation. The record may include the date the incident became known, the circumstances, the data affected, the data subjects, the risk assessment, corrective measures, notifications made and the reasons for not notifying.

Where applicable, security incident records will be kept for at least the minimum period set by ANPD regulations, currently five years for the regulated case, unless there is an additional obligation to keep them longer.

10. Responsible vulnerability disclosure

METADAX encourages responsible vulnerability disclosure. The preferred channel is:

Email: [email protected]

Alternative channel: metadax.com.br/bug-bounty

Contractual emergency contact: [email protected]

10.1 Scope

The scope must be published and kept as an up-to-date list containing only assets that METADAX controls or is authorized to test. The final version is to replace this provisional table:

Go to "metadax.com.br/bug-bounty" to check the list of permitted applications and their scope.

If the asset list has not been published, the program must not declare broad safe harbor coverage or authorize generic testing across the entire METADAX ecosystem.

10.2 Mandatory rules

Researchers must:

1. act in good faith, responsibly and within scope;

2. avoid degradation, outages, DoS, DDoS, spam, social engineering, phishing and physical access;

3. not access, copy, alter, delete, disclose or exfiltrate real data beyond the minimum necessary to demonstrate the flaw;

4. stop testing and notify METADAX when they come across personal data, credentials, secrets or third-party access;

5. not test people, employees, clients, suppliers or assets that are not included;

6. not install persistence mechanisms, malware or backdoors;

7. not disclose the vulnerability before reasonable coordination with METADAX; and

8. delete or return evidence and data received when requested, except what is necessary for proof or legal obligations.

10.3 Report content

The report must include a title, description, asset, steps to reproduce, impact, minimum evidence, suggested severity rating, date and a secure contact. Researchers must not include unnecessary personal data or secrets.

METADAX may request additional information, acknowledge receipt, rate the severity, report the fix or decide not to fix the issue when it is out of scope, a duplicate, not reproducible, low impact or incompatible with the service.

10.4 Limited safe harbor

To the extent permitted by law, METADAX will not seek to hold liable any researcher who acts in good faith, within scope, using authorized methods and in accordance with this Policy.

This protection is limited to the activities described and does not:

• authorize access to third-party assets;

• authorize processing, copying or disclosure of data beyond what is necessary;

• grant criminal, civil, administrative or contractual immunity before third parties;

• prevent measures needed to contain an immediate risk; or

• replace authorization from the client, provider, data subject, authority or asset owner.

METADAX cannot promise, in a private document, that any activity will automatically be considered authorized by all authorities, data subjects or third parties.

10.5 Rewards

Unless a campaign, amount and criteria are announced in writing, METADAX does not guarantee payment, reward, recognition or hiring as a result of a report.

If a reward is offered, requirements for eligibility, severity, duplicates, payment, taxation, identification and any disclaimer will be published.

11. Processing of researchers' and reporters' data

METADAX will process the data provided in the report to receive, validate, investigate, fix, communicate and document the vulnerability, as well as to protect rights and comply with obligations. Researchers should avoid sending unnecessary personal data.

The report may be shared with technical teams, security suppliers, affected clients or authorities when necessary and permitted.

METADAX may use the email address and contact details to respond to the report, not for marketing, unless there is another legal basis and authorization.

12. Vulnerability disclosure

Public disclosure will be coordinated according to the impact, the fix, active exploitation, the need to notify users, the availability of mitigation and security interests. METADAX may request a reasonable period to fix the flaw and prepare communications.

Researchers must not publish personal data, credentials, secrets, destructive proofs or instructions that facilitate exploitation before coordinating with METADAX. METADAX may publish acknowledgments by name or pseudonym only with the researcher's authorization.

13. Auditing, evidence and cooperation

METADAX may keep records of access, changes, incidents, risks, training, requests and security decisions for as long as necessary for security, auditing, the contract, the defense of rights and legal obligations.

B2B clients that require an audit, evidence of controls, a security questionnaire or independent testing must provide in the contract or security annex for the scope, cost, frequency, confidentiality, access, environment, notice, non-disruption and protection of other clients.

14. Continuity and recovery

METADAX will maintain proportionate procedures to respond to outages and restore services according to the nature of the operation. Testing, redundancy, RTO and RPO will only be promised when defined for the specific service.

Continuity may be affected by dependencies on the Client, platforms, APIs, cloud providers, registrars, financial institutions, the internet, power supply, third parties, force majeure or market changes. METADAX will report relevant limitations when known.

15. Exceptions and review

Exceptions to this Policy must be justified, approved by a competent officer, and have a defined term, scope and compensating measures where applicable. The Policy will be reviewed periodically or whenever there is a relevant change in services, risks, incidents, suppliers, legislation or regulations.

16. Channels

• Security and vulnerabilities: [email protected]

• Privacy and rights: [email protected]

• Data Protection Officer (DPO): [email protected]

• Contractual incidents: the channel set out in the proposal, contract or SLA.

Do not send credentials, private keys, health data, sensitive personal data or confidential information through forms or email without guidance from METADAX.

17. Relationship with other documents

This Policy must be read together with:

• the Privacy, Cookies and Communications Notice;

• the General Terms of Use and Contracting;

• specific contracts, proposals, service orders, DPAs, security annexes and SLAs;

• the Responsible Vulnerability Disclosure rules; and

• internal security and incident response procedures.

In the event of conflict, mandatory law prevails. The specific contract or annex prevails for expressly negotiated technical obligations and service levels, without reducing the legal rights of data subjects or consumers.

18. References

1. ANPD Board Resolution No. 15/2024 — Security Incident Reporting Regulation.

2. Law No. 13,709/2018 — Brazilian General Data Protection Law (LGPD).

3. ANPD Board Resolution No. 2/2022 — small processing agents.

4. ANPD guide on information security for small processing agents.

5. Brazilian Internet Civil Framework (Marco Civil da Internet) — Law No. 12,965/2014.