Trust and security — Crisarium
This page brings together, for the procurement, legal and security teams of customer organizations, what governs data protection in Crisarium. The security measures and the sub-processor list are Annexes I and II of the Data Processing Agreement, reproduced here without change.
Annex I — Security measures
- Data stored and processed in Brazil (São Paulo), encrypted in transit and at rest.
- Separation between organizations in the database, with row-level policies and an automated test, on every change, that tries to read another organization's data.
- Participants sign in through a personal link sent by email, with no password; each use is logged. Administrators and internal staff use a password and a mandatory second factor, with lockout after 3 failed attempts.
- The browser never accesses the database directly; credentials are kept in protected cookies.
- Crisis plan: only PDF and Word files, checked by their content; files with suspicious signs are rejected; read in memory without storing the file; extracted text encrypted until confirmation; the AI reading is isolated, with no tools and no access to other data.
- Internal staff do not access session content without the Controller's request or recorded authorization; all administrative actions are kept in an audit log.
- Emails always identified as a simulation, never asking for a password or payment, with a public page for checking invitations.
- Pinned dependency versions and automatic vulnerability alerts.
- Our own incident response plan, exercised.
Annex II — Sub-processors and international transfers
| Sub-processor | Activity | Data received | Place of processing | Transfer mechanism |
|---|---|---|---|---|
| Supabase Inc. (USA) | Database and authentication | All data under this Agreement, stored | São Paulo, Brazil | Data stored in Brazil; ANPD standard contractual clauses for any support access from abroad |
| Vercel Inc. (USA) | Application hosting and execution | Data in transit while building pages and reports | São Paulo, Brazil; global delivery network for public files | ANPD standard contractual clauses |
| Anthropic PBC (USA) | Artificial intelligence reading of the crisis plan and linking of rules to the scenario | Text extracted from the crisis plan and confirmed rules; no participant data | USA, not used for training | ANPD standard contractual clauses |
| Hostinger International Ltd. (Cyprus) | Sending emails (invitations, personal links, notices) | Participant's name, email and role; session and organization name | Brazil | EU adequacy (ANPD Res. CD/ANPD No. 32/2026) for the company in Cyprus |
Documents
- Data Processing Agreement, version 1.0
- Privacy Policy, version 1.3
- Terms of Use, version 1.0
- Refund Policy, version 1.0
Contacts
- Vulnerabilities and security: info@crisarium.com (security.txt)
- Privacy and data subject requests: privacidade@segurancaemjogo.com.br