Information Security Policy

1. Scope and responsibility

This policy covers the ImoDesk platform and the people and providers who operate it. Fátima & Tavares, Lda. is responsible for it; security contact: seguranca@imodesk.pt. We review this policy at least once a year and after any significant change or incident.

2. Data isolation and access control

• Each agency's data is logically separated; users only see their agency's data.
• Role-based access: agents, transaction coordinators and management see only what their role requires.
• Uploaded files can only be opened from the transaction they belong to.
• Access to production systems by our staff is limited to what is needed for operation and support, and is subject to confidentiality obligations.

3. Authentication

• Secure session cookies (HttpOnly, SameSite), with all sessions ended when a password changes.
• Password reset codes are stored hashed and expire.
• Login attempts are rate-limited by IP address and email.
• Client portal links are individual, protected by an access code, and stop giving access to documents when the transaction closes.

4. Encryption

• All connections use HTTPS (TLS), with HSTS enabled.
• Data is encrypted at rest by our storage and database providers.

5. Application security

• Uploaded files are checked by their real content type, not only by extension, and served in isolation so they cannot run code in the browser.
• Security headers and restricted cross-origin access (CORS).
• Incoming webhooks are authenticated with a shared secret.
• Dependencies are kept up to date and reviewed for known vulnerabilities.
• Changes are tested automatically before release.

6. Logging and monitoring

• Technical logs do not contain personal data.
• Every transaction keeps an activity history of who did what and when.

7. Data location and providers

Documents and the database are stored in the European Union. We use a limited set of providers, each bound by data protection terms; the current list is in our Privacy Policy. We review providers before use and when they change.

8. Artificial intelligence

Documents are processed by an AI provider only to extract data and flag inconsistencies for the customer. Customer data is not used to train AI models.

9. Backups and continuity

The database has continuous backups with our provider (MongoDB Atlas, European Union). Files and the database are also copied every night to a separate space in the European Union and kept for 30 days. We test restoring from backups at least once a year.

10. Incident response

We investigate suspected security incidents promptly. If a personal data breach affects a customer's data, we notify the customer without undue delay, and no later than 48 hours after becoming aware of it, so that the customer can meet its own legal obligations.

11. Demonstration environments

Demonstration accounts use fictitious data only and do not send real emails or messages.

12. Reporting a vulnerability

If you believe you have found a security issue, please contact seguranca@imodesk.pt. We appreciate responsible disclosure and will respond promptly.