Security and privacy

How Capto handles recorded data, integration keys and your code.

#Recorded data

• Password, phone, card, CVV and similar fields do not have their value recorded, only the number of characters.
• Before data goes to the AI or to cards, values of fields like password, token, key and authorization are masked in request bodies.
• Data is encrypted in transit and at rest, in the cloud, and handled in accordance with the LGPD (Brazil's data protection law). It is never sold or shared.

#Keys and tokens

• AI runs with your company's key: data goes straight from Capto to the provider you chose.
• Repository tokens require read-only access. Capto never changes your code.
• Prefer tokens with an expiry date and revoke the ones you no longer use.

#Access

• Everyone has their own login, with a role set by the admin.
• Reports are visible to the person who sent them and to company admins. The share link includes an access key.