Security & LGPD
Authentication, encryption and privacy treated as part of the build rather than as a review you scramble to pass. Written for products that hold real personal data.
What the work covers
The security work that stops a store rejection, a data leak or an awkward conversation with a regulator — done in the order that actually reduces risk.
Authentication done properly
Password hashing, session expiry, brute-force limits, and second factors where they earn their friction.
Encryption in transit and at rest
TLS everywhere, sensitive fields encrypted in the database, and keys kept somewhere other than the repository.
Privacy policy and terms
Documents that describe what the product genuinely does, written in language a user can follow, and kept in step when the product changes.
Data mapping for LGPD
What personal data you hold, where it lives, why you hold it and how long — the inventory every other obligation depends on.
Deletion and export flows
Account deletion that actually deletes, data export on request, and a record that both happened.
Review before you ship
A read of the code and the infrastructure for the failures that come up most: exposed keys, permissive access rules, and logs full of personal data.
What you end up with
- A written findings report, ranked by risk, with the fix for each item rather than just the finding.
- A completed Data Safety declaration and a privacy policy that matches the product behaviour.
- Working account deletion and data export flows, plus the public pages the stores require.
- A short set of practices your team can keep following after we leave.
What we work with
- LGPD
- OWASP
- TLS
- JWT
- Row Level Security
- Data Safety
- Play Console
- App Store Connect
How it runs
Map the data
Every place personal data enters, rests and leaves. Most surprises show up here.
Review
Code, configuration and access rules read against the failures that occur most often in products like yours.
Fix in priority order
Highest risk first, with the reasoning written down so the order can be challenged.
Document and hand over
Policies, declarations and the practices that keep it from drifting back.
Questions we get asked
Is this a penetration test?
No. This is secure engineering and LGPD compliance work — design, code, configuration and documentation. A penetration test is a different exercise, run by a specialist firm, and we will say so if that is what you need.
Does it make us LGPD compliant?
It covers the engineering and documentation side, which is most of what a small product needs. Compliance also has legal and organisational parts that belong with a lawyer, and we will tell you where that line falls.
Google Play rejected our app over data deletion. Can you fix it?
Yes, that is a common one. It usually needs an in-app deletion flow, a public deletion page and a corrected Data Safety form — we build all three and see the resubmission through.