Cyber Security Policy

Purpose

WEpayments’ Cybersecurity Policy establishes guidelines to protect customers, staff, partners, and the institution’s information, preventing risks and incidents related to information security and cybersecurity, in accordance with applicable regulations.

Scope

This policy applies to WEpayments, its senior management, staff, service providers, and business partners, and may be updated whenever necessary to comply with regulatory or legal changes.

Governance and Responsibilities

WEpayments has established a cybersecurity governance structure with clearly defined responsibilities, including the role of a designated director and a specialized committee, to supervise, enhance, and ensure the effectiveness of cybersecurity and data protection practices.

Security Principles

WEpayments’ cybersecurity actions are guided by the following principles:

• Confidentiality:  restricted access to authorised persons only.
• Integrity: protection against unauthorised changes.
• Availability: access to information whenever necessary.
• Authenticity: proper identification and authentication of users and systems.

General Security Guidelines

WEpayments implements controls and best practices to prevent unauthorised access, leaks, loss, and unavailability of information. This ensures that data is utilized exclusively for legitimate and authorized purposes.

Access Control and Credentials

Access to WEpayments systems and information is granted through formal identification, authentication, and authorisation processes that adhere to the principle of least privilege.

Additionally, security mechanisms like multi-factor authentication and controlled access to corporate systems are in place.

Enviroment and Device Security

WEpayments implements security measures to safeguard devices, technological environments, and information. These measures include physical and logical access controls, protection against malicious software, and secure configurations for corporate equipment.

Authentication and Security Model

WEpayments adopts a security model based on industry best practices, featuring centralized authentication and access controls to ensure that users, systems, and services possess only the permissions necessary to perform their respective functions.

Information Classification and Protection

Information is classified according to its criticality and sensitivity, with proportionate protection measures adopted to ensure its proper use, confidentiality, and integrity.

Risk Management

WEpayments implements an ongoing cyber risk management process that includes identifying vulnerabilities, assessing impacts, and adopting preventive and corrective measures to reduce incident exposure and ensure operational resilience.

Business Continuity

WEpayments has continuity and contingency plans to maintain or restore essential services during crises, including periodic testing to ensure their effectiveness.

Supplier Management

WEpayments implements security criteria when hiring and monitoring suppliers and partners, ensuring controls are appropriate for the criticality of services provided and establishing adequate mechanisms to prevent, detect, and respond to cybersecurity incidents.

Infrastructer Segmentation and Protection

WEpayments has a technological infrastructure designed to safeguard critical systems and data. This includes environment segregation, access controls, and continuous monitoring to prevent unauthorized access.

Backup, Restoration, and Availability

WEpayments implements data backup and restoration routines to ensure information availability and operational continuity, even during failures or incidents.

Recording, Logs, and Traceability

Systems are implemented to record and monitor significant activities in technological environments, ensuring audit trails and facilitating the investigation of security incidents and events.

Protection Agains Ciber Threaths

WEpayments implements measures to prevent and detect cyber threats, including malware, attacks, and unauthorized access attempts, alongside continuous updates and monitoring.

Testing and Continuous Improvement

Regular security tests and assessments are performed to identify weaknesses, improve controls, and continuously enhance the institution’s cybersecurity posture.

Security Incidents

WEpayments has established formal procedures for identifying, recording, handling, and responding to cybersecurity incidents. This includes communicating with relevant authorities and implementing measures to mitigate impacts and prevent future occurrences.

Security incidents must not be disclosed publicly and must be reported immediately to security@wepayments.com.br.

Once an incident is identified, the Director of Information Security and Cybersecurity is responsible for creating an action plan to address the issue and mitigate any damage.

Awareness and Training

WEpayments enhances awareness and training initiatives in cybersecurity and data protection, reinforcing a security-focused culture among staff, administrators, and partners.

Cloud Services and Third Parties

The hiring of processing, data storage, and cloud computing services complies with security, regulatory, and operational continuity requirements, including notifying Bacen when applicable.

Monitoring and Compliance

WEpayments implements monitoring, control, and audit mechanisms to ensure the effectiveness of this policy and compliance with current legislation and regulations.

Statement of Commitment

WEpayments reaffirms its dedication to cybersecurity, information security, and service continuity by implementing practices that comply with regulatory requirements and align with industry best practices.

Applicable Standards

WEpayments’ Cybersecurity Policy is developed and maintained in accordance with applicable laws and regulations for  Payment Institutions, including, but not limited to:

• Law No. 12,865/2013 outlines the regulations for Payment Arrangements and Payment Institutions operating within the Brazilian Payment System (SPB).

• BCB Resolution No. 01/2020 establishes the PIX payment arrangement and approves its associated regulations.

• Joint Resolution No. 01/2020 details the implementation of Open Finance.

•  BCB Resolution No. 80/2021  sets forth the requirements for the establishment and operation of Payment Institutions.

• BCB Resolution No. 85/2021 establishes a cybersecurity policy and outlines requirements for contracting data processing, storage services, and cloud computing.

WEpayments consistently monitors changes in the relevant regulatory framework and reviews this policy whenever regulatory updates occur..

Version Control