Security and privacy
Information Security Policy
Revision 7 — 11 June 2025. Quoretech protects information and preserves the confidentiality, integrity, and availability of data through a documented, continuously improved management system.
Policy
1
Purpose
Quoretech establishes guidelines and standards to protect information and preserve the confidentiality, integrity, and availability of data. The company seeks to maintain a culture of quality, security, privacy, trust, and transparency, supported by good practices and safe behaviour among employees, customers, and partners.
Quoretech is committed to continuous improvement of its Integrated Management System and to applicable business, information-security, data-privacy, and legal requirements.
2
Scope
This policy applies to employees, former employees, service personnel, representatives, and third parties who have had, have, or may have access to information or computing resources within Quoretech's organizational infrastructure.
3
Policy statement
The Information Security Policy is supported by specific documents, processes, controls, and tools. Employees and third parties must follow these controls in support of the organization's objectives.
4
Main components
- 1. Information Security Architecture: reference models and components based on system criticality.
- 2. Technological Asset Management: management of internal and external physical and logical assets.
- 3. Information Classification: classification and protection according to confidentiality and importance.
- 4. Information Security Awareness: programs that build safe behaviour and awareness.
- 5. Business Continuity and Recovery: minimum operating capability and recovery during disruption.
- 6. Data Protection: confidentiality, integrity, availability, and data-subject rights.
- 7. Remote Work: controls for secure work outside company facilities.
- 8. Identity and Access Management: controlled, segregated, and reviewed access.
- 9. Risk Management: identification and treatment of risks that may affect the organization.
- 10. Incident Response: coordinated response, containment, communication, and recovery.
- 11. Metrics and Reports: monitoring of exposure to information-security risk.
- 12. Network Security: protection of data transmission and infrastructure.
- 13. Information Security Operations: operation of security controls and support for users.
- 14. Privacy: protection of confidentiality and data-subject rights.
- 15. Monitoring: detection and prevention of unauthorized or harmful activity.
- 16. Secure Development: security practices throughout system development.
- 17. Security Strategy: alignment between security priorities and business strategy.
- 18. Third-Party Management: assessment of suppliers and partners against security requirements.
- 19. Threat Intelligence: identification of relevant threats and preventive action.
- 20. Vulnerability Management: detection, prioritization, and remediation of vulnerabilities.
- 21. Cloud Security: governance of cloud use and provider requirements.
5
Compliance and enforcement
- ABNT NBR ISO/IEC 27001:2022 as the policy framework and basis.
- LGPD, Brazilian Law 13.709/2018.
6
Roles and responsibilities
- Executive Management defines and endorses the policy, allocates resources, and promotes a security culture.
- Department Managers implement and enforce the policy and ensure team awareness and protection of sensitive information.
- IT and Security implement technical measures, conduct audits and risk assessments, manage access controls, and coordinate incident response and data recovery.
- Contributors follow policy, report incidents, and participate in training.
- Partners and Suppliers comply with contractual requirements and Quoretech standards.
- Legal ensures that agreements include appropriate compliance, data-use, and confidentiality provisions.
- Human Capital supports awareness, notifies IT of personnel changes, and coordinates return of information and technology assets.
- The Data Protection Officer monitors data-protection compliance, acts as liaison with authorities, and supports data-subject rights.
Contact
- Information security and Data Protection Officer
- seg.info@quore.tech