DNZ DESENVOLVIMENTO E TECNOLOGIA LTDA EPP maintains an information security program to protect Smart Gestor Plus and the data of customers, sellers, and partner platforms, including TikTok Shop protected data. This page is the public version of the program. Detailed internal policies are reviewed at least once a year.
1. Governance
- Sponsorship by DNZ leadership; annual policy review.
- Security and privacy channel: [email protected].
- Principles: confidentiality, integrity, availability, least privilege, and data minimization.
2. Network and hosting
Production, database, and backups reside in Brazil, on Hostinger VPS (212.85.17.79). Public HTTPS traffic passes through Cloudflare (CDN and reverse proxy), with TLS at the edge and DDoS mitigation, before reaching the origin server. Administrative access to the panel and server is restricted to authorized staff, with individual credentials. User traffic occurs only over HTTPS. Development environments do not use the production database as a playground.
3. Endpoints
Company equipment must have active antivirus (Windows Defender or equivalent), system updates, screen lock, and a prohibition on using unauthorized media with customer data.
4. Operational baseline
- Passwords with minimum complexity; hashed storage; authenticated sessions.
- Multi-factor authentication required on hosting panel, corporate email, Git, and TikTok Shop Partner Center.
- Automatic screen lock on workstations.
- Clean desk: do not leave documents or screens with personal data visible to third parties.
5. Access control
SG Plus isolates data by company. Users receive only the permissions of their profile (`permissao`). Platform Super Admin is restricted to SaaS operations. DNZ staff access to production follows need-to-know and is revoked upon offboarding. We review privileged access at least annually.
6. Classification and encryption
Personal data, API tokens, digital certificates, and marketplace payloads are confidential. In transit we use TLS 1.2 or higher. At rest, secrets and integration tokens are encrypted with the application key (AES via Laravel’s encrypter). Database volumes and backups remain with the Brazilian provider.
7. Vulnerabilities
PHP and JavaScript dependencies are updated with priority for security fixes. Known flaws are logged, prioritized (critical: 7 days; high: 30 days), and remediated. Automated tests cover critical flows before production release.
8. Incidents
Any suspicion must be reported to the security email. The team assesses impact, contains the event, preserves evidence, and notifies customers, ANPD, and TikTok Shop/sellers when protected data is involved. After an incident, we conduct a root-cause review.
9. Certifications
DNZ does not yet hold ISO 27001, ISO 27701, or SOC 2. The program above is the current control framework until those certifications are obtained.