LGPD and privacy
Under the LGPD (Brazil's data protection law), biometrics is sensitive personal data. The product was designed around that.
The data lifecycle
Capturevideo and framesstored
Evaluationscores and decisionstored
Retentionfor your policy's periodvideo deleted
Afterwardhashes and receiptkept
How the LGPD shows up in the product
- PurposeRequired on every session, with an optional legal basis — both recorded in the audit trail.
- CPFStored as a hash and a mask, never in plain text.
- RetentionThe video is deleted when your policy's period ends; the hash stays as evidence.
- Data subject rightsReport and deletion by CPF, in a single call (art. 18).
- Automated decisionsInconclusive cases go to human review (art. 20).
Who holds the data
- On Catalisa CloudCapture and decision happen on Catalisa infrastructure in Brazil, with our own engine. No face image goes to an outside vendor.
- With a dedicated installationEverything runs in your environment: you are the only one holding images, face enrollments and receipts, with your own keys and your own retention. Talk to sales