Security you verify — not take on faith.
Row-level isolation on every table, PII encrypted at rest, and the database, with its backups, in Brazil. On the right, the control that matters most in the form it actually exists: a test.
# illustrative output — the real suite runs on every code change
# last suite run: 10/30/26
Isolated per row.Row-Level Security on every table, per organization: one group’s query never reaches another’s data — not even through an application bug.
Encrypted at rest.CPF and date of birth in AES-256-GCM, with KEK/DEK envelope and secrets derived with Argon2id. Decrypted server-side only.
Stored in Brazil.Database and backups in sa-east-1 (São Paulo). The vendors that process data outside the country, such as the AI models, are on the subprocessors page, with each one’s country and transfer basis. Telemetry never receives personal data.
One CPF, four observers.
The same value exists in a different form for every system that touches it. Pick the observer.
Encrypted with AES-256-GCM and a KEK/DEK envelope: whoever copies the disk gets noise, not data.
Everything leaves a trace. No one erases it.
append-only trail
Every action — human, agent or AI — recorded with identity, object and instant. Immutable by design.
RoPA · 5-year retention
The record of processing activities LGPD requires, retained for 5 years and ready for your legal team.
access is an event
Reading personal data is recorded too: who decrypted, when, and for which action.
Defense in depth — not a silver bullet.
From a document upload to the specialist’s answer, six independent controls. None promises 100%; each covers the failure of the previous one.
Only text survives
Every file becomes canonical text before indexing: macros, scripts and active content are discarded in conversion.
Formal sanitization
Character normalization, size limits and rejection of command-injection patterns on input.
A document is data, never an instruction
Content enters the prompt as structured data, separate from system instructions — it cannot give the model orders.
CPF and birth date masked before the model
The CPF becomes a token and the date of birth an age range. Name, e-mail and phone number go through unmasked, because the experts need them.
Numbers checked on the way out
Deterministic validation: every cited value is checked against the books before it reaches you.
Reviewer + circuit breaker
An AI reviewer evaluates each answer; anomalous patterns halt the session and become a security event retained for 5 years.
Cross-organization isolation is tested adversarially on every code change — the suite at the top of this page.
Built for your legal team to say yes.
Data subject rights
Access, correction and deletion (DSAR) handled through a formal process, with deadlines and an audit trail.
Recording consent
A meeting is only recorded after each participant’s registered consent — without it there is no audio and no export.
Subprocessors
The complete list of vendors that process personal data on AutoController’s behalf — with each one’s purpose, processing locations and transfer basis — is published on the subprocessors page.
SubprocessorsPublished DPO
Direct channel for data subjects and for the ANPD:
Anderson Souza dos Santos
dpo@autocontroller.ai
And at the source, nothing changes.
What reads your ERP or DMS is an agent running on your server, read-only: encrypted credentials, zero writes, checkpoint after failure.