Information Security Policy

Tax360 is a platform of MaterImperium, a company specialized in the development of cloud solutions for business-critical operations.

1. Purpose and Scope

This Information Security Policy sets out the guidelines applied by MATER IMPERIUM LTDA, a legal entity governed by private law, enrolled in the CNPJ (Brazil's National Registry of Legal Entities) under No. 47.422.189/0001-74, to all systems, customer data and internal processes involved in the development, maintenance and operation of the Tax360 platform, in accordance with the ISO/IEC 27001:2022 (Information Security Management System) and ISO/IEC 27701:2019 (Privacy Information Management System) standards, and with the LGPD (Brazil's General Data Protection Law, Law No. 13,709/2018).

2. Governance and Certification

The information security management system of MATER IMPERIUM LTDA is certified to ISO/IEC 27001:2022 (certificate No. QMS-03358), together with its privacy extension ISO/IEC 27701:2019 (certificate No. QMS-03359), both issued by QMS Certification under IAS accreditation, with a scope covering the development, maintenance and operation of SaaS solutions for electronic tax document messaging, automation of ancillary tax obligations, solutions for Brazil's consumption tax reform and data analytics, including the management of the cloud technology infrastructure and technical support for the applications.

The validity of the certificates can be verified at iafcertsearch.org ↗ (opens in a new tab).

Information security is maintained through a continuous management system, with periodic risk analysis, internal and external audits, and a committee responsible for the annual review of this policy.

3. Access Control

Access to customer data follows the principle of least privilege, with multi-factor authentication, segregation by customer (multi-tenant architecture) and periodic review of permissions. We adopt a minimum-trust model (Zero Trust) applied to the entire technology infrastructure.

4. Encryption and Data Protection

Data in transit is protected by TLS 1.2 or higher encryption. Data at rest is encrypted with the AES-256 algorithm. Encryption keys are managed by a dedicated key management service (KMS), with periodic rotation.

5. Incident Management

Information security incidents are recorded, classified and handled according to the incident response plan defined by the organization. Incidents involving personal data are reported to the data subjects and to the ANPD (Brazil's data protection authority) within the deadlines and under the conditions established by the LGPD.

6. Monitoring and Audit

We carry out continuous monitoring of the production environment, periodic information security testing conducted by internal and external teams, and surveillance and recertification audits conducted by QMS Certification according to the current certification cycle.

7. Contact

Questions or requests related to this policy can be submitted through Data subject requests, the Trust Center or by email to dpo@materimperium.com.br.