Technology Architecture: Security, Quality and Compliance
Technical overview of the Tax360 platform architecture and infrastructure: how we organize security, quality and compliance at scale.
Modern Stack
-
Java 25
The product evolves along with the language, with no accumulated technical debt. Performance, security and stability with every release.
-
Always up-to-date dependencies
Continuous monitoring and updating of libraries and packages, reducing the attack surface.
-
Cloud infrastructure with auto-scaling and big data
Elastic scalability to absorb any processing volume.
-
Full observability
Real-time monitoring with distributed tracing, metrics and proactive alerts.
Security by Design
-
Centralized authentication (OAuth 2.0, OIDC, SAML 2.0)
SSO with corporate identity providers, unified access control.
-
Zero-day vulnerabilities
Proactive threat detection and response before threats become known exploits.
-
Encryption in transit and at rest
TLS 1.3 for communication and AES-256 for stored data.
-
WAF and DDoS protection
Perimeter defense against volumetric and injection attacks.
-
Environments isolated by purpose
Separate dev, staging and production, with no sharing of infrastructure, credentials or data.
-
Protected production data
No real data in dev/testing. Anonymized or synthetic data outside production.
-
Access control by environment
Restricted and audited permissions, production access recorded in an immutable log.
-
Pipeline-promoted deployment
Mandatory dev → UAT → production path, with automated checks at each stage.
-
Externalized and versioned configuration
Secrets and variables managed centrally and securely, with no hardcoding.
AI
-
Validated MCP for AI integration (in dev)
Protocol that lets AI agents connect to the platform in a secure and governed way.
-
Responsible AI use policy
Clear guidelines with transparency about which data is or is not used for training.
Security Awareness and Culture
-
Regular training
Mandatory training on information security and secure development.
-
Phishing and social engineering simulations
Ongoing tests to raise awareness of attacks targeting people.
-
Security onboarding
Every new employee is trained before getting access to systems.
-
Ongoing threat updates
Notices about new threats, vulnerabilities and regulatory changes.
Continuous Quality
-
Thousands of automated tests
Unit, integration and regression tests before every deployment.
-
AI-powered Code Review and Security Review
Automated review focused on vulnerabilities and good practices.
-
CI/CD pipeline with automated deployment
Frequent, controlled releases with automatic rollback.
-
Regular penetration testing
External validation by independent specialists.
Availability and Reliability
-
Contractual availability SLA
Contractual uptime commitment with continuous monitoring and a public status page.
-
Structured incident response
Detection, triage, containment and resolution with severity-based SLAs and automatic escalation.
-
Disaster Recovery (defined RTO/RPO)
Disaster recovery with maximum recovery time and data loss tested regularly.
-
Proactive client communication
Real-time notifications via the status page and direct channels during incidents.
Compliance and Certifications
-
ISO/IEC 27001:2022 (Information Security)
Formally certified security management system.
-
ISO/IEC 27701:2019 (Data Privacy)
Compliance with privacy frameworks such as the LGPD (Brazil's General Data Protection Law). Few Brazilian SaaS companies hold both.
-
LGPD compliance
Documented processes, an appointed DPO (Data Protection Officer), DPAs available and a RIPD (data protection impact assessment report) prepared.
Questions about security and privacy?
Talk to our team. We will reply by the email or phone number you provide.