---
title: "Cybersecurity Policy"
description: "Cumbuca's main cybersecurity guidelines, aligned with the institution's size, risk profile and business model. They guide the management of information systems and ensure the confidentiality, integrity and availability of data and services."
url: "https://www.cumbuca.com/en/cybersecurity-policy"
lang: "en"
---

# Cybersecurity Policy

Regulatory · BCB 85/2022. Cumbuca's main cybersecurity guidelines, aligned with the institution's size, risk profile and business model. They guide the management of information systems and ensure the confidentiality, integrity and availability of data and services.

- **Version:** 1.0
- **Date:** March 2023
- **Owner:** Information Security

> Courtesy translation. The Portuguese version is the legally binding document.

## Objective

To present the main cybersecurity guidelines aligned with Cumbuca's size, risk profile and business model. The policy guides the management of information systems and ensures the three fundamental pillars: **confidentiality, integrity and availability**.

## Overview

Cumbuca provides payment and financial organization services, which require secure communication channels between users and systems, with effective controls and with this policy implemented across the entire operational chain.

## Scope

Applies to all stakeholders in the procedures Cumbuca adopts to protect data and systems, including employees, service providers, suppliers, integration partners and end users.

## Applicable rules and standards

The policy observes the following regulatory framework:

- Law No. 13,709/2018 (**LGPD**), the General Personal Data Protection Law
- Law No. 12,965/2014, the **Brazilian Internet Civil Rights Framework**
- CMN Resolution No. 4,893, of February 26, 2021
- BCB Resolution No. 85, of April 8, 2022
- Internal standards reviewed periodically by the Information Security team

## Guidelines

Cumbuca operates under the following guidelines, audited at least annually by the Information Security team:

1. **Dedicated team** for cyber protection, with formally assigned responsibilities
2. **Secure data management** across the full lifecycle (collection, processing, storage, disposal)
3. **Periodic training** of employees in cybersecurity and data protection
4. **LGPD compliance** in every process involving personal data
5. **Secure software development**, with code review, static analysis and security testing
6. **Malware protection** on workstations, servers and applications
7. **Data integrity** through checksums, immutable logs and audit controls
8. **Continuous monitoring** of the infrastructure, with automated alerts for anomalous events
9. **Access management** based on least privilege and periodic review
10. **Information classification** by sensitivity, with proportional controls
11. **Partner due diligence**, cyber risk analysis before integration
12. **Incident prevention**, with playbooks and periodic simulations
13. **Business continuity plan (BCP)** with defined RTO and RPO targets
14. **Technological control** of endpoints, network and remote access
15. **Prevention of unauthorized disclosure** of information (DLP)
16. **Incident response** with timely notification to regulators where applicable
17. **Continuous review of critical suppliers** and supply-chain dependencies

## Maintenance

This policy is reviewed at least **annually**, or whenever there are relevant regulatory updates, significant changes to the business model, or security incidents that call for a review of controls.

## Contact

Vulnerability reports, incidents or questions about this policy should be addressed to the Information Security team:

- **Information security:** [security@cumbuca.com](mailto:security@cumbuca.com)
- **Responsible disclosure:** [/.well-known/security.txt](https://www.cumbuca.com/.well-known/security.txt)
- **Privacy / LGPD:** [privacidade@cumbuca.com](mailto:privacidade@cumbuca.com)
- **Ombudsman:** [ouvidoria@cumbuca.com · 0800 715 8075](mailto:ouvidoria@cumbuca.com)

---

## About Cumbuca

CUMBUCA Instituição de Pagamento Ltda., registered with the National Registry of Legal Entities of the Ministry of Finance (CNPJ/MF) under No. 44.353.942/0001-29, is authorized as a Payment Institution (IP), in the Payment Transaction Initiator (ITP) modality, regulated by the Central Bank of Brazil, pursuant to BCB Resolution No. 80 of March 25, 2021, and is a subsidiary of FAMÍLIA CUMBUCA HOLDING Ltda., registered with the CNPJ/MF under No. 32.670.659/0001-41.

CUMBUCA Serviços de Tecnologia Ltda., registered with the CNPJ/MF under No. 50.271.185/0001-47, is also part of the same corporate group.

- [This page in HTML](https://www.cumbuca.com/en/cybersecurity-policy)
- [Site index for LLMs (llms.txt)](https://www.cumbuca.com/llms.txt)
- [Sitemap](https://www.cumbuca.com/sitemap.xml)