The data belongs to the farm. Protecting it is our job.

In the cloud, in data centers run by large providers, with encryption and continuous backup. The farm doesn't need its own server. The providers are disclosed to the customer's IT team during contracting, under confidentiality.

Yes, in transit and at rest. All access uses HTTPS, with TLS 1.2 or 1.3, and the portal holds an A grade in a public check of its HTTPS configuration, repeated every month. At rest, the database is encrypted, backups included.

Backup is automatic and continuous, with point-in-time recovery, and it is encrypted. The recovery point objective (RPO) is 1 hour, and the recovery time objective (RTO) is 8 hours. The policy calls for a restore test at least once a year, in a separate environment.

The technical team and support, under the principle of least privilege and each with their own user account — every access is recorded in the log the farm can view and export. Internal access is reviewed every three months, and access for anyone who leaves the company is revoked within 24 hours.

No. Every access is recorded in the log, which the farm itself can view and export. And, if the farm wants, it can require support and outside consultants to state the reason for access when logging in; the justification is stored alongside the access record.

By user and by screen, with separate view, create, edit and delete rights. Each farm has an administrator who adds, changes and removes access for their own team, with no need to go through upCampo. Users are unlimited, so there's no incentive to share logins.

No. Each company's and farm's data is kept separate by permissions, and users only see the units their own company's administrator has linked them to. This also applies to answers from UPí.

Yes. The platform records who accessed it, when, on which screen, what operation they performed and whether it succeeded; the login record also stores the IP address and approximate location. Records are kept for at least 180 days, and the customer can view them and export to Excel from a portal screen, filtering by period, user or screen.

Yes. Every 15 minutes, an automated check scans the audit trail and raises an alert for repeated failed password attempts on the same user or access from a country outside the usual pattern of operation. Alerts are reviewed by the person responsible for security.

With deadlines based on severity (CVSS), set in the policy: critical within 7 calendar days, high within 30, medium within 90 and low in the next scheduled release. Application dependencies are scanned automatically every three months, and a critical vulnerability under active exploitation is handled as an incident.

The Incident Response Plan kicks in: containment within 4 hours of detection, impact assessment within 12 hours and notice to affected customers within 24 hours for high- and medium-severity incidents, even if the investigation is still ongoing. When personal data is involved and there is significant risk to data subjects, the ANPD (Brazil's data protection authority) is notified under Article 48 of the LGPD, within 3 business days.

Yes. upCampo acts as the processor of the data the customer enters into the platform and as the controller only of business contact data and security records. It has an appointed Data Protection Officer, whose contact details are in the privacy policy, and keeps the record of processing activities required by Article 37. Data subject requests are received by the Data Protection Officer and forwarded to the customer, as controller.

No. The contract prohibits using the data for any purpose other than providing the service. In the UPí connector for Claude and ChatGPT, each query is answered on the spot and the connector doesn't store the farm data: it goes only to the assistant the user connected, and what happens to the conversation from there (history, retention, use) follows Claude's or ChatGPT's rules and the user's account settings. upCampo does not use the data to train models.

Before closing the account, the farm exports whatever it wants through the reports, as spreadsheets, without opening a ticket. Afterward, the data is returned or deleted, with proof, within the period set in the contract.

With a token valid for 24 hours, obtained with the company's integration credentials, with the company and the farm fixed in the token itself. All traffic is HTTPS. The full documentation is public, at suporte.upcampo.com.br/api.

The connector uses OAuth and only reaches the farms the connected user already has access to. The password is checked at login and is never stored in the connector. Users can disconnect whenever they want, and the company administrator can suspend AI access in the user settings.

The Information Security Policy, the Incident Response Plan and the Record of personal data processing activities. If your company has its own questionnaire, send it along on WhatsApp or by email at contato@upcampo.com.br: we'll fill it out.

On WhatsApp at (65) 99937-3741 or by email at contato@upcampo.com.br. Suspected unauthorized access, a strange message sent in upCampo's name or a flaw you found: the sooner we know, the faster we act.