GRAALSOLUTIONS

Security at Graal

Security and privacy are part of the operating model.

Graal Solutions combines technical controls, documented processes and management-system governance to protect information and reduce operational risk.

ISO/IEC 27001 + ISO/IEC 27701

Our certified information security and privacy management systems provide a structured foundation for risk management, access governance, incident handling, continuous improvement and accountability.

Risk-based governance

Security decisions are prioritized according to risk, business impact and applicable requirements.

Access discipline

Least privilege, authentication controls and recurring access reviews are part of our security practices.

Monitoring & response

Centralized monitoring, alert handling and formal incident-response processes support faster detection and containment.

Continuous improvement

Audits, indicators, management review and recurring controls support an evolving security posture.

Policy

Public Information Security Policy

The following policy summarizes the principles and commitments that guide information security at Graal Solutions.

1. Purpose

Graal Solutions establishes this Information Security Policy to protect data belonging to clients, partners and employees, preserving the confidentiality, integrity and availability of information in accordance with market best practices and international standards.

Our commitment is to ensure that information security remains a strategic pillar for business continuity, client trust and legal compliance.

2. Scope

This policy applies to all employees, partners, suppliers and third parties who have access to Graal information or environments.

3. Information security principles

Graal adopts the following principles as its foundation:

  • Confidentiality: information is accessible only to authorized people.
  • Integrity: protection against unauthorized or improper changes.
  • Availability: information is accessible when needed.
  • Shared responsibility: everyone has a role in protecting information.
  • Continuous improvement: controls and processes evolve over time.

4. General guidelines

  • Information is treated as a strategic organizational asset.
  • Systems and data must be used only for legitimate professional purposes.
  • Access is granted according to the principle of least privilege.
  • All parties must comply with security, confidentiality and data-protection requirements.
  • Violations may result in disciplinary and legal measures where applicable.

5. Data protection and compliance

Graal operates in accordance with applicable legislation and standards, including Brazil's General Data Protection Law (LGPD), ISO/IEC 27001 and ISO/IEC 27701.

  • Access control and secure authentication.
  • Encryption of sensitive data.
  • Monitoring and activity logging.
  • Risk management and periodic audits.
  • Confidentiality agreements with employees and partners.

6. Risk and incident management

  • Identification, analysis and treatment of information-security risks.
  • Continuous threat monitoring.
  • Security incident response.
  • Communication with relevant stakeholders when applicable.

7. Business continuity

The organization maintains plans intended to support operational continuity and service recovery in the event of incidents, failures or disasters, reducing impacts to clients and partners.

8. Security culture

Graal promotes ongoing information-security awareness through training, communication and good practices, reinforcing that information protection is a shared responsibility.

9. Governance and continuous improvement

Information security is managed through an Information Security Management System (ISMS), supported by:

  • Performance indicators.
  • Periodic audits.
  • Management reviews.
  • Internal security governance.

10. Final provisions

This policy is reviewed periodically to preserve its effectiveness and alignment with strategic objectives, risks and applicable requirements.