Security

The Costa Mobility platform is still being built. This page describes the principles and the controls planned in its design. Before launch, it will be reviewed to reflect only what is in production. [CONFIRMAR: review this page against the production environment before launch.]

1. Principles

• Collect the minimum: we only ask for what the analysis and the service require.
• Human review where required: Mobility Blueprint and courtesy summary content reaches you only after an attorney's approval. The free Mobility Snapshot goes through automated validation instead and says prominently that it was not reviewed by an attorney.
• Least privilege: each team member accesses only what their role requires.
• Everything recorded: access, changes, approvals and consents leave a trail.

2. Planned controls

• Team dashboard with access roles and strong authentication for attorneys and operators.
• Per-account isolation in the portal: each client sees only their own data.
• An audit trail the application can only append to, never change or delete.
• Consent records tied to the exact version of the text accepted, with no later changes.
• Documents in private storage, downloaded through temporary links.
• Passwords stored only as hashes, and access tokens for connected services encrypted.
• Removal of data that directly identifies you before anything is sent to AI.
• AI providers configured through API or contract so that your inputs and outputs are not used to train models by default.
• No case content sent over WhatsApp.
• Verification that payment notifications really come from Stripe.
• Deletion and anonymization enforced by the system and passed on to integrated services.

3. What we do not have yet

We do not hold security certifications (such as ISO 27001 or SOC 2) and have not completed an independent audit. [CONFIRMAR: penetration test or independent assessment before launch.] We will update this page when that changes.

4. How to report a vulnerability

If you find a security flaw, write to tech@costa-mobility.com (opens in a new tab) [CONFIRMAR: security email]. Please do not access other people's data, do not disrupt the service, and give us reasonable time to fix the issue before disclosing it. We will respond to your report.

5. Incidents

If a security incident occurs that may pose a relevant risk or harm, we will notify affected people and Brazil's ANPD as required by the LGPD, and follow the attorney's professional confidentiality rules.

6. How to protect yourself

• Use a strong, unique password for the portal.
• Never share verification codes with anyone.
• We never ask for passwords or card details over WhatsApp or email. Our emails come from addresses on the @costa-mobility.com domain.

Sources and legal bases

• Law No. 13,709/2018 (LGPD), consolidated text (Portuguese) (opens in a new tab): arts. 46 (security measures) and 48 (incident notification).
• New York Rules of Professional Conduct, Rule 1.6 (confidentiality) (opens in a new tab): (c), reasonable efforts to prevent unauthorized access.

[CONFIRMAR: English version drafted by the team from the Portuguese text of 11/01/2026; pending the attorney's review]