Compliance built into delivery
Enterprise buyers need to know how a supplier handles confidentiality, data and ethics before they sign. This page sets out our position plainly, so procurement and legal teams can evaluate us without a discovery cycle.
Data protection
| Legal framework | Brazilian LGPD (Law 13.709/2018) as the primary regime, with GDPR-aligned practices where EU personal data is involved. |
| Role | We act as controller for our own commercial contacts and as processor for client data processed inside a project. |
| Data processing agreement | Available on request for any engagement that involves personal data. |
| Rights requests | Handled through info@esupercorp.com with a documented response process. |
Information security
Isolated computation
Our core risk engine runs in an air-gapped configuration. Key calculations do not depend on third-party APIs, so sensitive process parameters stay inside our controlled environment.
Least privilege
Access to project data is restricted to the people who need it, with role-based permissions and revocation on project close.
Traceability
Processing steps are logged. Every model run is parameterized, so results can be reproduced and defended in an audit.
Encryption in transit
All access to our platforms is over TLS. Credentials are stored separately from project data.
Next step: procurement documentation
For RFP and vendor qualification we prepare the full package — company data, attestations and references.
Confidentiality and NDA
Industrial risk projects routinely expose sensitive information: process design, inventories, incident history, commercial data. We treat all client material as confidential by default. We sign client NDAs and can provide our own standard agreement. On project close, documents are returned or destroyed at your instruction and access is revoked.
Ethics and anti-bribery
We do not offer, promise or accept undue advantage to obtain or retain business, in either the public or private sector. We do not make facilitation payments. We avoid conflicts of interest and disclose any relationship that could reasonably affect our independence in an engagement. Our reports state assumptions and limitations explicitly – we do not tailor findings to a desired outcome.
Technical integrity
Documents we publish carry a cryptographic fingerprint anchored to the Bitcoin blockchain via OpenTimestamps. This proves the document existed in a given state on a given date and has not been altered since. It is verifiable by any third party, without trusting us.
This matters in industrial risk work: a study can be shown to predate an event, which protects both client and supplier in any subsequent inquiry.
Standards and alignment
| Process safety | HAZOP studies structured to IEC 61882; LOPA per IEC 61511; consequence analysis per recognized international practice. |
| Contaminated sites | CETESB P4.261 and equivalent state frameworks in Brazil. |
| Risk management | ISO 31000 principles applied to project governance and decision making. |
| Quality | ISO/IEC 17025 and good manufacturing practice support where a project requires accredited-quality discipline. |