Security
Isolation by design, encryption in transit and at rest, audited infrastructure and human approval on everything that matters. Not marketing — architecture.
Your methodologies, your clients, your conversations, your reports — they're yours. If you leave, you take it all. Our copies are destroyed within 30 days of cancellation.
Guarantees
Never shared between workspaces.
Isolation guaranteed by Row Level Security in Postgres.
Infrastructure audited to SOC 2 Type 2 and ISO 27001.
Certifications for the infrastructure where your data lives.
Compliant with the LGPD.
Personal data processing follows Brazil's General Data Protection Law.
Technical controls
Row Level Security in Postgres guarantees every workspace is an island. No query can return data from another tenant — isolation lives at the database layer, not the application. Even a bug in the code can't cross that boundary.
Every connection between your browser and the platform runs over TLS. Database, files and backups are encrypted with AES-256 across the infrastructure, with daily database backups.
The agent prepares, you decide. Sending a proposal, an assessment or any external communication goes through your review before it goes out — it never happens autonomously.
Every relevant action by the agent is logged and searchable — what was done, when, and in what context. Not a promise: it's the log that already runs in production.
Your data runs on independently audited infrastructure, and processing follows the LGPD and the GDPR.
Security, availability and confidentiality controls audited by a third party.
Certified information security management system.
Security controls specific to cloud services.
Protection of personal data processed in the cloud.
Information privacy management system.
Payments at the industry's highest level. Cards never touch our servers.
Database, files and backups encrypted at rest. TLS in transit.
Designated data officer, documented lawful basis and data subject rights.
EU/EEA data subjects with documented lawful basis and transfers.
Personal data processing follows the LGPD. EU/EEA data subjects have the lawful basis and international transfer details described in the GDPR notice.
Found a vulnerability? We want to know before anyone else. Report technical details to contact@consultor.app. We respond within 48 hours with confirmation of receipt and a resolution timeline.
Please don't disclose publicly before coordinating with us. Researchers who follow this process get public credit when the fix ships. There's no financial bounty program at this time.
Need technical security details for your InfoSec team's review?
Updated in September 2026
