✦ security

Security Posture

uInspect delivers infrastructure that carries critical evidence for claims, court proceedings and regulatory audits. Security is not a feature, it is a requirement for the product to exist.

Chain of custody

Each piece of media captured through the platform receives, at the moment of capture:

  • Server timestamp (we do not rely on the device clock)
  • GPS coordinates recorded by the app's native camera, with estimated accuracy
  • Author identity tied to the authenticated user account
  • Unique identifier of the case and the originating workspace

The final report includes the complete chain of custody, exportable as defensible evidence in dispute and audit.

Encryption

  • In transit: TLS 1.3 on all client-server connections
  • At rest: AES-256 encryption for persisted data in storage
  • Backups: encrypted with rotated keys
  • Internal communication: internal services authenticate each other via mTLS

Access control

  • Mandatory authentication with strong passwords and MFA available (TOTP, push)
  • SSO via SAML 2.0 and OIDC for corporate clients
  • Granular permissions per workspace, team and user (least privilege principle)
  • Audit trail of all administrative actions (creation, deletion, permission changes)
  • Sessions with automatic expiration and centralized revocation

Infrastructure

  • Hosting with a cloud provider holding ISO 27001, SOC 2 Type II and PCI DSS certifications
  • Environment segregation (production, staging, development)
  • Server hardening: automatic security updates, application firewalls, DDoS protection
  • Daily backups with retention configurable per workspace
  • Disaster recovery with RPO and RTO documented in corporate contracts

Availability

Corporate clients have a contractual availability SLA. Operational status can be followed at status.uinspect.com.br (under construction).

Fraud prevention

  • Detection of tampering attempts in capture metadata (altered GPS, forged time)
  • Behavioral analysis for anomalies in capture patterns (volume, times, location)
  • Automatic blocking of uploads that fail chain of custody validation
  • Alerts to operators in suspicious cases, before the report is closed

Privacy by design

Product decisions treat privacy as a requirement from the design stage:

  • Minimal collection of personal data
  • Full segregation between workspaces (client A never sees client B's data)
  • Anonymization wherever possible in internal statistics
  • Retention limited to the period the purpose requires
  • Ability to export and delete data at the data subject's request

Incident response

We maintain a formal incident response process with:

  • An on-call team for critical incidents
  • Communication to affected clients within 24 hours
  • Notification to the ANPD in the cases provided for by the LGPD, Brazil's General Data Protection Law
  • Public post-mortem for relevant incidents (with no sensitive data)

Responsible disclosure program

Security researchers are welcome. To report vulnerabilities responsibly, write to security@uinspect.com.br with:

  • A description of the vulnerability
  • Steps to reproduce
  • Estimated impact
  • A suggested mitigation, if any

We commit to acknowledging receipt within 48 hours and to reporting back on triage within 5 business days.

Certifications

We are in the process of pursuing ISO 27001 and SOC 2 Type II certification. Estimated completion dates are shared on commercial request.

This policy is evolving. Some certifications and tools listed are still being implemented. For current status and technical detail, ask your sales contact. This page is a courtesy translation of the Portuguese original, which prevails in case of divergence.