Scope
Rules of engagement
Authorized targets, locations, systems, time windows, prohibited actions and escalation paths are recorded before operational work begins.
Security, privacy and responsible operations
TRUST CENTER.CONTROL BEFORE COLLECTION.
The Trust Center explains how VEXTRACE scopes authorized work, handles information, uses analytical automation and separates professional credentials from institutional certifications.
01Authorization before collection
02Source provenance retained
03Human analytical control
04Need-to-know access model
01
Operating controls
Controls are adapted to the engagement, data classification and applicable legal requirements.
Data
Minimization and retention
Collection is limited to the mission objective. Retention and deletion periods are defined by contract, legal obligation and evidentiary need.
Analysis
AI-assisted, human-controlled
Automation may accelerate classification, extraction and correlation, but material judgments and client-facing conclusions remain subject to human review.
Evidence
Provenance and traceability
Relevant sources, collection times, transformations and analytical notes are preserved to support verification and audit.
Access
Least privilege
Case access should be limited by role, mission and need-to-know. Production client access requires authenticated and audited controls.
Disclosure
Responsible reporting
Security findings are handled through coordinated disclosure, client authorization and contractual communication channels.
02
Certifications and standards — accurate representation
The scope of every credential should be stated clearly.
Company certifications
Institutional status
Only certifications formally issued to the legal entity should be represented as company certifications. Scope and validity should be confirmed in the commercial proposal.
Professional credentials
Individual competence
Professional certifications validate the knowledge or examination status of named practitioners and must not be presented as institutional certification.
Methods and references
Framework alignment
References to MITRE ATT&CK, PTES, OWASP, NIST or ISO describe methodological alignment unless an active certification explicitly states otherwise.
Program membership
NVIDIA Inception
Vextrace is a member of NVIDIA's Inception Program for Startups — a startup support program, not a technical certification. It is represented here as a partnership, distinct from the certifications above.
03
Trust resources
Policy
Privacy & LGPD
General privacy principles and data-subject communication channel.
Security
Data Handling
Classification, transfer, retention, deletion and evidence controls.
Ethics
Responsible Use
Authorized, proportionate and legally grounded intelligence operations.
Security
Responsible Disclosure
How to report a vulnerability in VEXTRACE-owned assets.
Availability
Service Status
Published components and configuration dependencies.
Legal
Terms of Service
General site and engagement principles pending contract-specific terms.
This public Trust Center is an operational summary, not a substitute for a signed NDA, data-processing agreement, rules of engagement or legal advice. Contract-specific controls prevail.