Pular para o conteúdo

Security

Security is not a feature. It is an architectural premise.

Gaia Prime runs on the GSO Tier-0 (Gaia Security Operations) specification. This page summarizes the public guarantees we provide. For technical details under NDA, architectural review or penetration testing, reach out via contact.

Zero-Trust by construction

No internal call assumes trust. Every request goes through cryptographic verification, with short-lived identity and scope.

Tenant isolation (108 RLS policies)

Each customer's data lives isolated by Row-Level Security on PostgreSQL — 108 active policies covering the business tables. No cross-tenant query is possible — prevented by construction, not by convention.

Signed BFF (HMAC-SHA256)

The bridge between frontend and backend is signed with HMAC-SHA256. Every request carries an envelope whose integrity is verified before processing.

Signed audit log

Sensitive events (access, configuration change, message send) are recorded on an immutable trail, with chained signatures to detect tampering.

Secrets outside the code

Credentials and tokens live in a dedicated vault, with periodic rotation and least-privilege scope. No keys in versioned environment variables.

LGPD compliance

Personal data mapping, legal basis per purpose, support for subject rights (access, rectification, deletion). Designated DPO. Granular opt-out per message category, with STOP honored immediately.

100% official Meta API

WhatsApp connects exclusively through the Meta Cloud API (Tech Provider, Embedded Signup). Zero unofficial QR-code connections — the method that exposes numbers to bans on other platforms simply does not exist here.

PII protection + MFA + WAF

Personal data is automatically redacted in application logs. Panel access requires MFA. Input sanitization (WAF) at the edge and integration credentials encrypted at rest.

Compliance roadmap

We operate under LGPD today with the GSO Tier-0 posture described above. Next certifications on the roadmap, in priority order:

  1. SOC 2 Type I — evidence preparation and auditor selection in 2026.
  2. SOC 2 Type II — natural sequence after Type I.
  3. ISO/IEC 27001 — evaluation in parallel depending on enterprise customer demand.

We do not announce certifications we don't have. We update this page as soon as each seal is effectively issued.