Information Security and Data Protection Policy

1. Scope and ownership

• Legal entity: ROBSON BARBOSA DA SILVA DESENVOLVIMENTO DE SOFTWARE LTDA
• Trading name: RRZ TECH · CNPJ 66.931.784/0001-80 · Brazil
• Product: RRZT 3D — B2B SaaS for production, cost and inventory management for 3D printing businesses
• Data Protection Officer: atendimento@rrzt3d.com.br

This policy applies to all systems and data of RRZT 3D, including seller data obtained through marketplace integrations. It is approved and maintained by the company owner, who also acts as Data Protection Officer.

2. Security baseline for daily operations

• Company endpoints run Windows 11 with Microsoft Defender real-time protection enabled, automatic screen lock and full-disk encryption.
• Multi-factor authentication is enabled on all critical provider accounts: hosting, source control, database and e-mail.
• Application passwords are stored using bcrypt with a per-password salt, never in plain text. A minimum length is enforced and legacy hashes are transparently upgraded on next sign-in.
• Sessions expire after inactivity and are invalidated when a user's access is revoked.

3. Access control and least privilege

• The platform is multi-tenant with schema-level isolation: each customer's data lives in a dedicated database schema, and every request is bound to the authenticated tenant.
• Three application roles (administrator, supervisor, operator) restrict access by function. Cost, margin and financial data are not visible to operators.
• Administrative access to cross-tenant tooling is limited to an explicit allow-list of accounts.
• Infrastructure credentials are held only by the owner and stored as provider-managed secrets, never in source code or in the repository.
• Access to production data is limited to what is necessary to operate and support the service.

4. Data classification and encryption

All traffic uses HTTPS/TLS and plain HTTP is redirected. Database connections require TLS. Backups are encrypted in transit and at rest by the storage provider.

5. Network and infrastructure security

• The application runs on a managed platform (Fly.io) in an isolated virtual machine in the São Paulo region. No port other than 443 is publicly exposed and there is no public administrative interface.
• The database (Neon, São Paulo) is reachable only over TLS, with credentials held as secrets.
• Application-layer controls: rate limiting on authentication and registration endpoints, CSRF protection (SameSite cookies plus origin validation), upload size limits and archive validation, and parameterised queries on all database access.
• Availability is monitored continuously by an external check. Unhandled application errors and memory pressure trigger automatic alerts to the administrator.

6. Vulnerability and threat management

• Security reviews are performed periodically and whenever a significant feature is added. The most recent full review covered authentication and sessions, cross-tenant isolation, injection, cross-site scripting, CSRF, file uploads and payment handling; all findings were remediated.
• Dependencies are kept current, and platform components are patched by the managed providers.
• Findings are prioritised by exposure and impact. Any issue that could expose customer data is treated as highest priority and fixed before other work.

7. Incident response and breach notification

• Detection. Automatic alerts (application errors, availability, resource pressure) reach the administrator. Customers and partners can report incidents to atendimento@rrzt3d.com.br.
• Roles. The company owner is the incident lead and single point of contact, acting as Data Protection Officer.
• Containment and assessment. Affected credentials are rotated immediately and affected access is revoked. Scope, data categories and affected customers are determined from application and platform logs.
• Notification. Where a confirmed or suspected personal data breach affects data obtained from a marketplace or its sellers, RRZT 3D notifies the marketplace and the affected sellers without undue delay and within 72 hours of becoming aware, stating what happened, the data categories involved, the measures taken and a contact point. Notification to the Brazilian authority (ANPD) and to data subjects follows the LGPD where applicable.
• Post-incident. Root cause is documented and corrective measures are implemented and recorded.

8. Retention, deletion and data subject rights

• Customer data is retained while the account is active. Upon termination, all data held for that customer is permanently deleted, including the tenant database schema, stored files, sessions and control records. Deletion is performed by a single dedicated routine so that no residual data is left behind.
• Backups follow a rolling retention schedule and expire automatically.
• Requests to access, correct, export or delete personal data are honoured, including requests originating from a marketplace or from its sellers on behalf of their users.

9. Data location and subprocessors

Primary storage and processing of customer data take place in Brazil. Subprocessors are bound by their own data protection terms. RRZT 3D does not sell customer data and does not share it with third parties for advertising or any purpose unrelated to the service.

10. Privacy compliance

RRZT 3D complies with the Brazilian General Data Protection Law (LGPD, Law 13.709/2018). Terms of Service and the Privacy Policy are published and reviewed regularly, and acceptance is recorded with date and time. We hold no ISO 27001 or SOC 2 certification, and we state that openly rather than implying otherwise.