Privacy and Security

Security architecture

Six practices, declared and auditable

End-to-end encryption

Data encrypted at rest (AES-256) and in transit (TLS). None of your data travels or sits in plain text.

Restricted, named access

Only the two partners access your project data, with two-factor authentication. No contractors, no extended team, no exceptions.

Per-client segregation

Every project runs in a logically segregated environment. One client’s data never mixes with another’s.

Used only on your project

Your data serves your project and nothing else: it does not train third-party models, it does not become a benchmark, it does not leave the agreed perimeter.

Minimum necessary

We integrate only the sources and fields required by the contracted scope. Never “everything, just in case”.

Secure development

Code written to industry-recognized secure coding guidelines, reviewed by the partners themselves.

Law No. 13,709/2018

LGPD compliance

When processing data on behalf of and under the instructions of our clients, BLYXX acts as processor. For the contact data of prospects and visitors to this site, it acts as controller. In both roles, the commitments listed alongside apply in full.

The legal bases for processing are performance of contract e o legitimate interest, documented case by case. At the end of each contract, project data is returned and/or deleted on request, with formal confirmation.

Data Protection Officer (DPO)

Requests concerning personal data — access, correction, deletion, portability — should be directed to dpo@blyxx.ia.br. We respond to every data subject request.

Data subject rights (art. 18): confirmation of processing, access, correction, anonymization, deletion, portability and information on sharing — guaranteed and operational.
Minimum retention: data processed only for as long as the contracted scope requires.
Incidents (art. 48): in the event of an incident carrying material risk, we notify the client and, where applicable, the Brazilian data protection authority (ANPD).
No sale or sharing: client and visitor data is never sold or shared with third parties for commercial purposes.

Documentation

Security white paper

Security and Privacy on the BLYXX Platform

The full document: security architecture, roles and commitments under the LGPD, data lifecycle, subprocessors, continuity, incident handling and the certification roadmap — in full, for your legal and IT teams to review.

PDF · v1.1 · July 17, 2026 · 10 sections · in Portuguese

Download the white paper

No borrowed badges

What we do not have yet — and when we will

As of today, BLYXX does not hold formal certifications such as ISO 27001 or SOC 2. Certification is on the roadmap, tied to the launch of the self-service platform. Until then, we offer what is on this page: declared practices, verifiable in contract and auditable at any time. We will claim the badge when it exists — not before.

Trust is shown in detail, not in badges.