Security and LGPD
No fine print: what Control does today to protect quotes, payments and accounts, and what you can ask for about your data.
The database and files (such as PDFs) live on Google Cloud, in the São Paulo region: your quotes, clients and payments are stored in Brazil. Sign-in (Google’s Firebase Authentication) and email delivery (Resend) use services with infrastructure outside Brazil.
Everything between your browser and Control travels over HTTPS (TLS). The database only accepts encrypted connections, and stored data is encrypted at rest, as is standard on Google Cloud.
On top of your password, you can require a six-digit code from an authenticator app on your phone. Two-step verification is available to everyone and recommended for admins.
The database is copied every day, and the copies from the last seven days are kept. We don’t just trust that backups exist: restoring one has been tested end to end.
Each client sees only their own quotes and installments. On your team, you choose which clients each person can see.
Sign-in is handled by Google’s Firebase Authentication, and that’s where your password lives. Control doesn’t store it anywhere: when you set it through your invite, it only passes through our API on its way to Firebase.
Invite and quote links carry a long random code. In our database, we keep only a scrambled version of it (a hash), never the link itself.
LGPD, Brazil’s General Data Protection Law, gives you and your clients rights over personal data. We take that seriously day to day.
We process the data the service needs to work: your account, clients, quotes and files, payments and, for security, technical access records (such as IP addresses and logs, kept for up to 30 days). To improve the product, we also process usage data; on the websites, only with your permission.
What you put into Control stays yours, and you can take all of it with you.
Ask for a copy of your data whenever you want. On Pro, you can also export quotes and payments to XLSX right in the app.
If you decide to leave, ask us to delete your account and the data tied to it. Backup copies that still hold that data expire on their own within 7 days.
Privacy contact
privacidade@harpialab.com(example)
The most common questions about data, plans and cancelling are in the FAQ.