und3r networks
Information security

Information Security Policy

This policy summarizes the principles and controls UND3R Networks applies to protect the information of the company, its clients and partners.

Last updated: October 21, 2026Version: 1.0

01Purpose and scope

This policy applies to all employees, contractors and partners who access information or systems of UND3R or our clients, in the office, in the field or remotely.

02Principles

  • Confidentiality: information is accessed only by those who need it for their work
  • Integrity: information is kept accurate and complete, free from improper changes
  • Availability: systems and data are accessible when the business needs them

03Access control

  • Access granted on a least-privilege basis and reviewed periodically
  • Individual, non-transferable credentials with two-factor authentication on critical systems
  • Immediate access removal on termination or role change
  • Passwords and keys kept in a vault, never in plain text

04Infrastructure and networks

  • Network segmentation, with guest networks separated from corporate networks
  • Regular updates of operating systems, firmware and applications
  • Equipment pre-configured and bench-tested before installation at the client site
  • Monitoring of availability and security events

05Secure development

  • Version-controlled code, reviewed before going to production
  • Separate development, staging and production environments
  • Automated, traceable deployments
  • Client data never used in test environments without anonymization

06Backup and continuity

  • Periodic backups of critical systems and data
  • Restore tests to confirm backups work
  • Documented procedures to resume operations after failures

07Suppliers and partners

Contractors who access sensitive information sign confidentiality agreements and follow the applicable requirements of this policy.

08People and awareness

Employees receive guidance on good practices such as spotting phishing attempts, protecting devices and reporting incidents. UND3R also produces awareness campaigns for its clients.

09Security incidents

Every incident is logged, analyzed and handled to contain its impact and prevent recurrence. When an incident involves personal data and may cause relevant risk or harm to data subjects, we notify the affected clients and the ANPD, as required by the LGPD.

10Reporting a vulnerability

If you find a possible security flaw in UND3R systems, write to d.freitas@und3rnetworks.com describing the issue. Please do not disclose it publicly before we have analyzed and fixed it.

Talk to us