Security
The Platform was designed so that data remains, at every stage of processing, under the exclusive control and custody of the public authorities, in a secure, transparent and auditable environment, observing the privacy and security principles of Brazil's General Data Protection Law (Law No. 13,709/2018).
Under Brazil's LGPD the contracting party, always a government public security institution, is the data controller, Pax is the processor and the citizen is the data subject. Pax processes data only on the contracting party's instructions and does not decide how it is used.
01data ownership and access
Operated by Pax, held by the government, belonging to the citizen
Clear ownership and jurisdictional control
- Data is stored and processed securely inside the country, meeting data residency requirements and staying under Brazilian law.
No commercialisation
- Control and custody of citizens' data stay entirely with the public authorities: Pax does not collect, sell or repurpose any data.
Two kinds of data, neither of them Pax's
- Citizens' data and public institution data: The Platform handles citizens' data and the public institution's data. Pax always acts as the data processor, following the guidelines set by the public authorities.
- Pax's role: Pax is the provider of the processing tool: it is not the data controller and has no free access to the data. Use is restricted to previously credentialed public security professionals.
Retention
- Retention and deletion: Retention and deletion rules are set by the public institution, ensuring citizens' data is kept only as long as required.
- Irreversible deletion: At the end of the retention period, data is purged from the Platform, permanently and irreversibly.
02transparency and traceability
A complete, unalterable trace
Unalterable records of platform actions
- No edits, no deletions: Every action on the Platform writes an audit record that can only be created: never edited, never deleted.
- Identity and timestamp metadata: Traceability of access and queries is preserved in full: the public institution can reconstruct which officer accessed which data, and when.
- A barrier against abuse: Instead of opening a door to abuse, the technology creates a trail of accountability: public oversight, traceability, and a concrete barrier against leaks.
The principle of least privilege
- Permissions are set by role and by attribute. Each user sees only the records and fields their role requires, and the rest stays hidden.
Purpose-bound data sessions
- Access to data is bound to a purpose, with justification at the moment of use, and every access is logged alongside full contextual metadata for audit and review.
03governance, security and compliance
Proven security
Encryption at rest and in transit
- At rest: Data encrypted with AES-256.
- In transit: All traffic crossing the public internet requires TLS 1.2 or higher.
- Key management: Keys are managed in a service separate from the application, with their use and lifecycle defined by policy.
Secure authentication and authorisation
- Multi-factor authentication is required for access to critical systems and protects officers' credentials, so that a compromised credential is not enough on its own to reach citizens' data.
Continuity and data integrity
- Redundant copies: The data modules keep redundant backups, so an infrastructure failure does not mean losing police records.
- 24/7 monitoring: Infrastructure is monitored 24 hours a day, seven days a week, with automated alerts routed to an on-call team. An anomaly is caught at any hour, not only during business hours.
04responsible AI
AI under human control
AI that assists human judgement
- A person always decides: The Platform's AI is assistive: it organises and presents evidence, it never decides. Every critical decision stays with the public official, who decides from the evidence presented.
- Deterministic guardrails: Where precision is required, AI behaviour is constrained by defined business and policy rules, so that outputs stay predictable, auditable and aligned with operational intent.
AI that is controlled, explainable and traceable
- Interpretable outputs: AI outputs are never presented without an explanation: the user sees the reasoning and the supporting evidence, not only the result.
- End-to-end provenance: Every AI output carries the full lineage of what produced it, linking directly back to the underlying evidence, so the user can verify the source before acting.
Continuous transparency
The Trust Center holds our current certificates, the full control list, subprocessors and change notices. Its content is updated continuously: controls are monitored, subprocessor changes are published, and new certificates appear as soon as they are issued.