Privacy Notice

Part 1. Summary in Plain Language

What we do with your information

This summary explains, in a simple and direct way, how Vulnera ("Platform," "we") collects, uses, stores, and protects your personal data. It does not replace the complete Privacy Notice, which is in Part 2 of this document, but serves as a quick guide to understanding it.

If you have any questions about privacy and data protection, contact us at privacidade@vulnera.io. For general matters, use the e-mail contato@vulnera.io.

Who is responsible for processing?

Vulnera acts as the Controller of the personal data you provide to create and use your account. We rely on partner companies (processors) that help us provide the service, such as the cloud provider, payment method, e-mail delivery, and monitoring, always under our instructions and within the limits of the law.

However, when you contract an analysis in an authenticated area of your own environment, the technical evidence captured may contain personal data of third parties that exist in your system. In that scenario, the person who makes the decisions about the processing of that data is you, in the capacity of Controller, and Vulnera acts as Processor.

How do we secure your data?

Vulnera adopts the measures recommended by the ANPD for small-sized agents, proportional to the risks of the service. In practice, this includes passwords stored as a hash, an optional second authentication factor, encryption of credentials at rest, redaction of passwords, tokens, and cookies before records are written, role-based access control, and continuous monitoring of the infrastructure.

What data is collected?

• Site visitor: only the technical records generated by access, such as IP address, date, and time. Audience-measurement cookies are only recorded if you agree; advertising cookies are not used.
• Account User: e-mail, password, company name, and, when provided, personal name, CPF (Brazilian individual taxpayer ID), and phone number. Added to this are session and audit records, subscription data, and all content you submit for analysis. When subscribing by Boleto, the payment processor also collects your CPF or CNPJ and your address, which are not stored on Vulnera's servers.

The data collected is the same for all account User profiles. What changes between Owner, Member, and Viewer is the scope of what each can do, not the set of data they provide.

For what purposes do we use your data?

To enable the contracted service, authenticate your access, run the analyses, generate reports, bill the subscription, provide support, comply with legal obligations, and keep the Platform secure and available. The breakdown by type of data is in the table in Clause 6.

Who do we share your data with?

Only with the partners necessary for the operation, listed by name in Clause 3.3, and when required by court order or legal determination. Vulnera's main infrastructure (hosting, database, cache, queues, and containers) is located in the United States, which already constitutes an international transfer, addressed in Clause 3.4; some of the other partners also maintain infrastructure outside Brazil. Customers' assets, code, and findings are not sent to third-party scanning services.

Will your access logs be collected?

Yes. We keep IP address, source logical port, and date and time of access, confidentially, for at least 6 (six) months, as required by the Marco Civil da Internet. Today the Platform is configured to retain these records for 365 days.

Is there indirect data collection?

Yes, but in a well-defined way. On every successful login, your IP address is used to infer city, region, and country, precisely so that you can identify accesses you do not recognize. We also use error and performance monitoring tools. We do not use camera, microphone, GPS, push notifications, fingerprinting, third-party chatbots, or marketing cookies. What is stored in your browser is the session token and your light or dark theme preference.

Will communication records be stored?

Yes. Support takes place by e-mail, and we keep that history to improve support and as evidence of the interactions.

What are your rights and how do you exercise them?

You have the rights set out in article 18 of the LGPD, detailed in Clause 8. There are two ways to exercise them: self-service within the Platform itself, available to those who are authenticated, and the e-mail privacidade@vulnera.io. We respond within up to 15 (fifteen) days, and whatever can be resolved immediately, in simplified form, is resolved on the spot.

What does the Notice contain?

The complete Notice contains the following clauses:

(a) Effective date;

(b) Glossary and User profiles;

(c) Processing agents;

(d) Information security;

(e) Data collection;

(f) Processing of personal data;

(g) Cancellation, deletion, and retention periods;

(h) Data subject rights and response deadlines;

(i) Changes to the Notice;

(j) Privacy communication channel;

(k) Contact for general matters.

Part 2. Privacy Notice

1. Effective date

1.1. This Privacy Notice was made available and takes effect as of 29/09/2026.

2. Glossary and User profiles

2.1. To facilitate understanding of this Notice, the definitions of the main terms used are set out below:

• Controller: the natural or legal person responsible for decisions regarding the processing of personal data.
• Processor: the natural or legal person that processes personal data on behalf of the controller.
• Data Protection Officer (DPO): the person appointed by the controller to act as the communication channel among the controller, the data subjects, and the ANPD.
• Personal data: information related to an identified or identifiable natural person.
• Sensitive personal data: data about racial or ethnic origin, religious belief, political opinion, union membership, data concerning health or sex life, genetic or biometric data, when linked to a natural person.
• Data processing: any operation carried out with personal data, such as collection, use, access, transmission, storage, deletion, transfer, or extraction.
• Encryption: a data encoding technique intended to prevent unauthorized access to information.
• Hash: an irreversible representation of a piece of information, which allows it to be verified without storing it in a readable format.
• IP (Internet Protocol): an identification number assigned to each device connected to the internet.
• Asset: a domain, URL, API, or code repository registered by the User to be submitted to security analyses.
• Finding: a vulnerability or weakness identified in an analysis, together with the corresponding technical evidence.
• Cookies and local storage: small files or records kept on the User's device to enable browsing and store preferences.

2.2. The following are considered Users of the Vulnera Platform:

2.2.1. Visitor: a person who accesses the institutional site or public pages, without registering and without authenticating.

2.2.2. Registered User: an authenticated person who is part of an organization that has contracted the Platform. The data collected is identical for all the profiles below. What distinguishes them is the scope of the permissions assigned to each:

• Owner (holder of the organization). Profile created at the moment of registration. Only the Owner invites and removes members, subscribes to and cancels the subscription, deletes assets, declares authorization over the analyzed asset, and consents to the attack mode applied in the analysis.
• Member. Operational-use profile: registers assets, triggers analyses, views findings, generates reports, and configures integrations.
• Viewer. Read-only profile, with no power to make changes.

2.2.3. Administrator: an internal profile, assigned exclusively by the Vulnera team and not available on the account invitation screen. It grants access to an administrative panel with the list of customer organizations, users with their e-mail and role, registered assets, subscriptions, analysis counts, and access session history, including IP address, device, and approximate location. Its purpose is exclusively support and operation of the service, and access is restricted to the people who perform these functions.

3. Processing agents

3.1. Vulnera acts as Controller of the personal data collected directly from its Users, being responsible for defining the purposes and means of processing that data, under the terms of this Notice.

3.2. Vulnera acts as Processor with respect to personal data of third parties that may be contained in the technical evidence captured during analyses, especially in analyses performed in an authenticated area of the customer's environment. In that case, the contracting customer is the Controller of that data, and it is up to the customer to define the purpose and legal basis of the processing, with Vulnera processing such data only to the extent necessary to perform the contracted analysis and in accordance with the instructions received.

3.2.1. Vulnera recommends that, prior to contracting authenticated analyses, the customer assess whether personal data exists in the analyzed environment and adopt the appropriate measures, including recording that operation in its own processing inventory.

3.3.2. Dynamic analyses are performed with the OWASP ZAP tool, and code analyses with Vulnera's own engine, both run within Vulnera's own infrastructure on AWS. Customers' assets, source code, and findings are not sent to third-party scanning services.

3.3. To enable the provision of the service, Vulnera relies on the following processors, which process personal data on its behalf and under its instructions:

• Amazon Web Services (AWS). Hosting, database, cache, queues, container execution, and infrastructure security telemetry. Infrastructure located in the United States of America (us-east-2 region).
• Google. Authentication, when the User chooses to sign in with a Google account.
• Stripe. Payment processing by card, Link, and Boleto, and subscription management. Card data is provided directly to the provider and does not pass through Vulnera's servers. For payment by Boleto, the provider collects the payer's name, CPF or CNPJ, address, and e-mail to issue the boleto.
• OpenAI. Generation of explanations and recommendations through artificial intelligence, when the feature is enabled. The finding's title, severity, description, and category are sent. Credentials, secrets, or the raw technical evidence are not sent.
• Resend. Sending of transactional e-mail, currently limited to password reset. Receives the data subject's e-mail and the corresponding link.
• ip-api.com. Inference of approximate location from the IP address, at the moment of login.
• Sentry. Application error monitoring, including session replay under the conditions described in Clause 5.8.
• New Relic. Application performance monitoring and logging.
• Slack. Receipt of internal incident alerts by the Vulnera team.
• Doppler. Management of infrastructure secrets and environment variables.
• Hostinger. Provider of the Vulnera.io domain's mailboxes.

3.3.1. This list will be updated whenever a processor is added, replaced, or removed, and the version in force is the one published on the Platform.

3.4. All processors and any sub-processors are responsible for the secure processing of the personal data made available to them, and using that data for purposes other than those established here is prohibited, under penalty of civil, criminal, and administrative liability before the ANPD.

3.5. International transfer. Vulnera's main infrastructure, including hosting, database, cache, queues, and container execution, is located in the United States of America, and some of the other processors listed in Clause 3.3 also maintain infrastructure outside Brazil. Both situations constitute an international transfer of personal data. The transfers are carried out in strict observance of the LGPD and Resolução CD/ANPD nº 19/2024, through the adoption of the Standard Contractual Clauses approved by the ANPD or another transfer mechanism admitted by law, ensuring an adequate level of protection for the transferred data.

3.5.1. The transfer of the User's IP address to the geolocation provider, described in Clause 5.3, occurs on every successful authentication and has the sole purpose of allowing the User to identify accesses to their account that they do not recognize.

4. Information security

4.1. Considering Vulnera's size as a small-sized agent, the Platform adopts the security measures recommended by the ANPD's Guidance Guide for Small-Sized Processing Agents, observing the principles of necessity, adequacy, and proportionality in relation to the risks involved.

4.1.1. The measures include technical and administrative controls aimed at the prevention, detection, response to, and recovery from incidents, focused on preserving the confidentiality, integrity, and availability of the information processed.

4.2. Among the measures currently implemented are:

• Storage of the User's password exclusively as a hash, with no possibility of recovery in readable form.
• A second authentication factor available to the User, with the secret and recovery codes also stored as a hash.
• Encryption at rest of the credentials and integration tokens provided by the User, with decryption restricted to the moment the analysis is executed.
• Automatic redaction of authentication headers, cookies, and fields containing a password or token before application logs are written.
• Masking of text and form fields, and blocking of media, in the monitoring tools that capture session replay.
• Access control segregated by profile, with an audit log of the actions taken on the account.
• Security telemetry and continuous monitoring of the cloud infrastructure, with internal incident alerts.
• Single-use password reset token, valid for 30 (thirty) minutes.
• Logical isolation by organization (tenant), with data queries scoped to that boundary.
• Encryption in transit via TLS on connections with the database and the cache (Redis), plus encryption at rest enabled on both.
• Network restriction: services run inside a VPC, with databases and cache accessible only to authorized security groups.
• Automatic daily backup of the database, managed by AWS, with a retention window of 1 (one) day.

4.3. Users' access logs are kept confidential, in a controlled and secure environment, for at least 6 (six) months, under article 15 of Lei nº 12.965/2014 and article 7º, II, of the LGPD. The Platform is currently configured to retain these records for 365 (three hundred and sixty-five) days.

4.4. Vulnera undertakes to maintain the stability and security of the Platform, exercising reasonable diligence to that end. However, it is not liable for unlawful intrusions carried out by unauthorized third parties, and in such cases it undertakes to adopt the measures necessary to identify the party responsible and cooperate with the competent authorities, as well as to notify the data subjects and the ANPD when the incident may cause relevant risk or harm.

5. Data collection

5.1. Registration data. When the account is created, the e-mail, password (stored as a hash), and company name are collected. The personal name is optional and can be filled in later, on the profile screen.

5.1.1. The CPF and phone number fields exist in the database and are accepted by the profile update routine, but are not requested by any screen of the Platform in the current version. Should they come to be collected, they will be processed for User identification and operational contact, under the terms of Clause 6. The CPF or CNPJ collected by the payment processor for payment by Boleto, described in Clause 5.5.1, is not recorded in these fields.

5.2. Authentication. The User can sign in by e-mail and password or by Google account. When signing in with Google, the e-mail and basic profile scopes are requested, and Vulnera stores the e-mail, name, and identifier of the Google account. The User can also enable the second authentication factor.

5.3. Session records and approximate location. On every successful authentication, the IP address, browser, operating system, device type, city, region, country, and date and time of access are recorded. City, region, and country are inferred from the IP address, through a query to the provider listed in Clause 3.3, and the purpose is to allow the User to recognize unauthorized access to the account. These records are available to the User on the account management screen.

5.4. Audit records. The user, the organization, the action taken, the description, the associated metadata, the IP address, and the date are recorded, for purposes of traceability and incident investigation.

5.5. Subscription data. The plan, status, billing period, amount, and identifiers assigned by the payment processor are processed, as well as, for payment by Boleto, the pending status and the due date of the boleto. Card data, including when provided through Apple Pay, Google Pay, or Link, is provided directly to the processor and does not pass through Vulnera's servers.

5.5.1. Payment by Boleto. To issue the boleto, the payment processor collects the payer's name, CPF or CNPJ, address, and e-mail directly from the payer. This data is not recorded on Vulnera's servers, which only record the payment status and the due date of the boleto. Vulnera's team may consult it in the processor's dashboard when necessary for User support, payment reconciliation, refunds, and compliance with tax obligations.

5.5.2. Link. Link is Stripe's own service that lets the User save their name, payment details, contact information, and address for future purchases. By choosing Link, the User has a direct relationship with Stripe, and the processing of this data is governed by Stripe's terms and privacy notice. Vulnera has no access to the payment details saved in Link.

5.5.3. Refund of a payment by Boleto. Since a payment by Boleto cannot be reversed through the processor, a refund due under the Terms of Use is made by bank transfer. For this purpose, Vulnera asks the User for the name and CPF or CNPJ of the holder of the destination account and the details of that account (bank, branch, and account number, or PIX key).

5.6. Content submitted by the User. To perform the service, the Platform processes the registered assets (domains, URLs, APIs, and repositories), proof of ownership of the asset (DNS record or file published on the asset itself), the acceptance of the analysis authorization with the corresponding IP address and date, the analysis schedules, the vulnerability findings with the corresponding technical evidence, and the reports generated.

5.6.1. The technical evidence captured in analyses performed in an authenticated area may contain personal data of third parties existing in the customer's environment. That processing is subject to the regime set out in Clause 3.2.

5.7. Credentials for authenticated analyses and integrations. This feature is available in the Platform's settings area and accepts the following formats:

• Username and password for the customer's environment. The User provides the URL of the login route, the name of the username and password fields, the credentials, the submission format (form or JSON), and, optionally, free extra fields, through which they can indicate a static token, an additional header, or another value required by their environment's login. The password is encrypted at rest and decrypted only at the moment of the analysis.
• Per-asset API token. Used in API analyses, encrypted at rest.
• Code repository tokens. Granted via OAuth. On GitHub, through an installed application, with a token generated on demand and valid for one hour. On GitLab and Bitbucket, with an access token and refresh token, both encrypted. The connected account and the scopes granted are also stored.
• Tokens issued by Vulnera itself. Webhook token and personal MCP integration token, the latter stored only as a hash and displayed only once, at the moment of creation. The OAuth clients authorized by the User are also recorded.

5.7.1. Session cookie is not a format accepted by the Platform; there is no field intended for that purpose.

5.7.2. Credentials are used exclusively to run the analyses authorized by the User and may be removed by the User at any time in the settings area.

5.8. Passive collection and monitoring. In addition to the records already described, the Platform performs the following collections:

• Error monitoring. The IP address and the user identifier are recorded. The tool records session replay only when an error occurs, with all text and all form fields masked and media blocked.
• Browser performance monitoring. Page visits, load times, and calls to the Platform's own API, without the body of the requests. Session replay and session tracking functions are disabled.
• Application logs. Only requests with errors and the IP address are recorded, applying the redaction described in Clause 4.2.
• Load balancer access logs. Cover all requests, with source IP address, User-Agent, URL, and time, stored in a bucket under Vulnera's control.
• Cloud infrastructure security telemetry. Aimed at monitoring the environment and detecting suspicious activity.

5.9. Technologies not used. For the User's clarity, Vulnera declares that the Platform and the institutional site do not use:

• Access to the device's camera or microphone.
• Location collection via GPS or the browser's geolocation API.
• Push notifications, service worker, or notification provider. Communications are limited to transactional e-mail and real-time updates within the open screen.
• Fingerprinting techniques, such as identification via canvas, audio, fonts, or device identifier.
• Online chat, chatbot, or third-party support widget, on the site or on the Platform. Support is provided entirely by e-mail.
• Marketing cookies, targeted advertising cookies, or behavioral profiling cookies.

5.10. Cookies and local storage. Storage in the User's browser includes the session token, necessary to maintain authentication, the light or dark theme preference, and the record of the User's choice about non-necessary cookies. The institutional site uses the Google Analytics 4 tool for audience measurement, whose cookies are recorded exclusively after the User's consent, as detailed in the Cookie Policy.

5.10.1. Audience measurement is subject to consent collection under the terms of the Cookie Policy, available in the footer of every page.

5.11. Contact history. Vulnera stores the content of communications maintained by e-mail with the User, for the purpose of improving the quality of support and serving as evidence of the interactions carried out.

6. Processing of personal data

6.1. By using the Platform, the User acknowledges the processing of their personal data under the terms of the table below, which indicates the type of data, the legal basis set out in the LGPD, and the specific purpose of each processing activity:

6.2. Personal data of third parties possibly contained in the technical evidence is not included in the table above because, with respect to that data, the definition of purpose and legal basis is up to the contracting customer, in its capacity as Controller, under the terms of Clause 3.2.

6.3. Vulnera does not process sensitive personal data nor process data of children and adolescents, and the Platform is not intended for persons under 18 (eighteen) years of age.

6.4. The results generated by automated processing or by artificial intelligence, including severity classification and risk prioritization, are technical recommendations and do not constitute an automated decision that produces legal effects or a significant impact on the User, under the terms of article 20 of the LGPD, and are always subject to human review.

7. Cancellation, deletion, and retention periods

7.1. Vulnera may cancel the User's access in the event of inappropriate conduct, violation of the Terms of Use or applicable law, or misuse of the services.

7.2. The User may request cancellation of the account at any time, through the self-service available on the Platform itself or by e-mail to privacidade@vulnera.io.

7.3. Once the purpose of the processing has ended, or upon the data subject's request, the personal data will be deleted within a maximum of 30 (thirty) calendar days counted from the request. In the current configuration, the Platform performs the deletion 7 (seven) days after the request, a period intended to allow the data subject to reconsider and for operations in progress to be completed.

7.3.1. In the absence of an express deletion request, Vulnera keeps account data for up to 1 (one) year after the account is closed, and vulnerability findings and the corresponding technical evidence for up to 1 (one) year of account inactivity, after which they are deleted.

7.4. Deletion does not reach, under the terms of article 16 of the LGPD:

• Access records, kept for at least 6 (six) months under article 15 of Lei nº 12.965/2014, currently configured for 365 (three hundred and sixty-five) days.
• Billing records and tax documents, kept for 5 (five) years, to comply with legal, tax, and accounting obligations.
• Data necessary for the regular exercise of rights in judicial, administrative, or arbitration proceedings.
• Data whose retention is required by law or regulatory rule.

7.5. Data retained on the basis of Clause 7.4 remains under restricted access and is deleted at the end of the respective period or of the purpose that justified the retention.

8. Data subject rights and response deadlines

8.1. Under the terms of article 18 of the LGPD, the User, as the holder of personal data (data subject), may request from Vulnera:

8.1.1. Confirmation of the existence of processing of their personal data;

8.1.2. Access to the personal data processed;

8.1.3. Correction of incomplete, inaccurate, or outdated data;

8.1.4. Anonymization, blocking, or deletion of unnecessary or excessive data, or data processed in noncompliance with the LGPD;

8.1.5. Portability of the data to another service or product provider, upon express request;

8.1.6. Deletion of data processed on the basis of consent, except for the retention cases provided for by law;

8.1.7. Information about the public and private entities with which Vulnera has shared data;

8.1.8. Information about the possibility of not giving consent and about the consequences of that refusal;

8.1.9. Revocation of consent, when applicable.

8.2. Channels for exercising rights. The authenticated User can exercise their rights directly on the Platform, through the self-service available in the account area, which allows opening requests for access, correction, anonymization, portability, deletion, and revocation of consent, exporting their data in a structured format, and requesting deletion of the account, with tracking of the deadline. Alternatively, and for data subjects who are not Platform users, the request can be sent to privacidade@vulnera.io.

8.2.1. Should Vulnera receive requests from data subjects in its capacity as Processor, it is up to the Controller User to respond to them.

8.3. Response deadlines:

• Complete statement about the data processed: within up to 15 (fifteen) days counted from receipt of the request, under article 19, II, of the LGPD. Whatever can be answered immediately, in simplified form, will be answered on the spot.
• Deletion of data: completed within up to 30 (thirty) calendar days, subject to the exceptions in Clause 7.4.

8.4. Service hours. The privacy channel is staffed on business days, from 9 a.m. to 6 p.m., Brasília time. Requests received outside that period have their deadlines counted from the following business day.

8.5. To respond to the request securely, Vulnera may adopt reasonable measures to verify the identity of the requester, especially when the request is not made from an authenticated account.

9. Changes to the Privacy Notice

9.1. Vulnera may amend this Notice whenever necessary to reflect legal, operational, or technological updates. The changes take effect as of publication on the Platform.

9.2. Material changes, especially those that involve the inclusion of a new purpose, a new processor, or a new instance of international transfer, will be communicated to the User by e-mail or by a prominent notice on the Platform.

9.3. In cases where the change involves processing that depends on specific consent, the User will be given the option to freely and knowingly accept or decline, without prejudice to the use of features that do not depend on that processing.

9.4. Should the User disagree with the changes, they may end their relationship with the Platform by canceling the account, without this releasing them from obligations previously assumed.

10. Privacy communication channel

10.1. Due to Vulnera's size as a small-sized agent, formal appointment of a Data Protection Officer is waived, under the terms of Resolução CD/ANPD nº 2/2022.

10.2. Notwithstanding this waiver, Vulnera maintains a specific channel for matters related to privacy and the protection of personal data, through the e-mail privacidade@vulnera.io, intended to receive questions, requests, and complaints from data subjects, as well as communications from the National Data Protection Authority. Access to this channel is restricted to the people responsible for handling these matters.

10.3. The Platform's Terms of Use form an inseparable part of this Privacy Notice, together forming a single set of rules applicable to the relationship between Vulnera and its Users.

11. Contact for general matters

11.1. For general communications, support, business matters, and contractual legal matters, the User may contact Vulnera by e-mail at contato@vulnera.io.

11.2. The report of a vulnerability identified on the Platform itself should be sent to contato@vulnera.io, identifying the subject in the message's subject line.

Identification of the Controller

Vulnera

Legal name: Vulnera Cibersegurança Inova Simples (I.S.)

CNPJ: 69.317.570/0001-06

Address: Rua 9, nº 1102, Apto 1102, Norte (Águas Claras), Brasília/DF, CEP 71908-540

Privacy e-mail: privacidade@vulnera.io

General contact e-mail: contato@vulnera.io

Effective date: 29/09/2026