Data protected and LGPD compliant

We sort out how your company collects and stores personal data, and we close security gaps to prevent attacks. If one has already happened, we help you contain the damage and get back to work.

LGPD compliance for companies, attack prevention with penetration testing, access management, updates, backups and team training, and incident response after an attack, with containment, data restoration and a report on what happened.

What we deliver

  • LGPD compliance
  • Attack prevention
  • Penetration testing
  • Incident response

Who it's for: Companies that handle personal data from customers and employees, and companies that have been attacked

Why MProtect

  • Paperwork and servers together: A privacy policy on its own won't stop a leak, so we handle the document and also the passwords, the access and the backups.
  • Attack prevention: We close the doors an attacker tries first: weak passwords, leftover access and systems that haven't been updated. And we train the team to spot scams.
  • A plan for the bad day: If an attack happens, you already know what to shut off and where to restore from. Afterward, you get a report on how they got in.

What MProtect is

MProtect is the MFactor service that looks after data protection. It's three jobs that go together: bringing the company in line with the LGPD (Brazil's data protection law), preventing attacks, and getting operations back when one happens.

The LGPD applies to any company that holds data about people: customer records, employee files. Even the contact list on the company WhatsApp counts. And attacks don't pick by size. A program sweeps the internet looking for weak passwords and systems that haven't been updated, and gets in wherever it can. A small company gets swept just like a big one. The difference is that at the small one, almost nobody is watching.

What we do is the groundwork. Knowing what data the company has and where it lives. Who has access to what. What happens if a laptop gets stolen or the server wakes up encrypted. With that in order, a good part of what the LGPD asks for is already in place. And if an attack does happen, there's a backup to restore and a plan to follow.

Signs your company is exposed

  • One password for everything: Email and the bank account share the same password, and it's on a sticky note on the monitor.
  • People who left can still log in: Someone left the company a year ago and their login still works for email and the system.
  • A backup nobody has tested: There's a copy somewhere, but nobody has ever tried to restore it. Sometimes it sits on the same server that would be attacked.
  • A customer spreadsheet making the rounds: Names, tax IDs and phone numbers travel by email and WhatsApp. Nobody can say how many copies exist or who has them.
  • A form that explains nothing: The website asks for a name and phone number and doesn't say what it's for or how long it's kept.
  • Someone asked and nobody knew the answer: A big customer sent a security questionnaire. Or someone asked to have their data deleted. The company didn't know where to start.

LGPD compliance

MProtect handles the technical side and the processes. Contracts and legal opinions stay with your lawyer, and we work alongside them.

  • Data mapping: what personal data the company collects, where it's kept, who has access and how long it's stored.
  • Documents and processes: privacy policy, cookie notice, a record of processing activities and a channel for people to request their own data.

Attack prevention

  • Penetration testing: we try to get into your website, system or API the way an attacker would, and hand you the list of what we found.
  • Access and passwords: two-step verification, each person with only the access they use, and nobody who has left still holding a working password.
  • Updates: operating system, plugins and servers kept up to date, with a routine so they don't fall behind again.
  • Tested backups: a copy outside the main environment and a rehearsed restore, with a date set to do it again.
  • Email protection: SPF, DKIM and DMARC set up, so nobody can send fake email in your company's name.
  • Team training: how to spot a fake email, a suspicious link and an odd request on WhatsApp.

Attack recovery

  • Containment and restore: we isolate what was hit, change the credentials and restore from backup.
  • Report and notification: how they got in, what was exposed, and help notifying the ANPD (Brazil's data protection authority) and the people affected.

Been attacked? Do this first

  • 1. Take it off the network: Unplug the affected machines from the cable and the Wi-Fi. Don't wipe anything: the files hold the clues to how they got in.
  • 2. Change passwords from another device: Start with email and the bank, using a computer or phone that wasn't hit.
  • 3. Don't pay in a panic: Paying the ransom doesn't guarantee you get the data back. Before you decide, see what can be recovered from the backup.
  • 4. Write down what happened: The time, the message on the screen, who noticed first. It shortens the investigation and helps if you need to notify the ANPD, Brazil's data protection authority.

How it works

  • 1. First conversation: You tell us how the company works, which systems it uses and what worries you most. If an attack is in progress, the work starts with containment.
  • 2. Assessment: We map the personal data, the access, the systems and the backups, without changing anything in your environment.
  • 3. Report with priorities: What's exposed, the risk of each item and the cost to fix it, from most serious to least.
  • 4. Fixes: We start with what an attacker would use first: passwords, access, updates and backups.
  • 5. Documents and training: Privacy policy, a record of processing activities and a short training so the team can spot scams by email and WhatsApp.
  • 6. Ongoing support: Periodic reviews and new tests. And someone to call when a question or an incident comes up.

Who it's for

  • Companies that store customer data: and have never checked whether they comply with the LGPD.
  • Clinics, schools and accounting firms: that hold sensitive information about other people, like medical records and tax returns.
  • Online stores and SaaS companies: that got a security questionnaire from a big customer and don't know what to answer.
  • Anyone who has never been attacked: and wants to keep it that way.
  • Anyone who has been attacked: and needs to get back to work, find out how they got in, and not go through it again.

Frequently asked questions

My company is small. Do I need to comply with the LGPD?

Yes. The LGPD, Brazil's data protection law, applies to any company that handles personal data, and that includes your customer records and payroll. For small businesses, the ANPD (Brazil's data protection authority) simplified some of the obligations, and in most cases they don't have to appoint a data protection officer. The basics stay the same: know what data you hold, protect it, and have a channel for the data subject, the person the data belongs to.

How much does LGPD compliance cost?

It depends on how many systems the company uses and how much personal data runs through them. That's why the assessment comes before the quote: the price comes from what we find, and you choose what to fix first.

Do you replace our lawyer or our data protection officer (DPO)?

No. We handle the technical side and the processes: data mapping, security, operational documents and training. Legal opinions and contracts stay with the company's lawyer, and we work alongside them. As for the DPO, we help you decide who takes on the role and give that person the technical support they need.

What is a penetration test?

It's an attack you've agreed to. We try to get into your website, system or API the way an attacker would, with written authorization and a set time window, and we deliver a report with each flaw, its risk and how to fix it. After the fixes, we test again.

Can an attack be prevented?

There's no such thing as total protection, but you can close the most common doors: two-step verification on your accounts, systems kept up to date, a backup outside the main environment with a tested restore, and a team trained to spot scams. We get those four things working and come back from time to time to check they're still in place.

I've been attacked. What do I do now?

Take the affected machines off the network, don't wipe anything, and change your passwords from a device that wasn't hit. Then message us on WhatsApp. The work starts with containment, moves on to restoring from backup and ends with a report on how they got in. Without a backup, it isn't always possible to recover everything, and we tell you that in the first conversation.

Do I have to notify the ANPD if there's a data leak?

When the incident could cause significant risk or harm to the people whose data was exposed, yes. Notifying the ANPD and those people has a deadline of three business days, counted from when the company finds out personal data was affected. We work out what was exposed and prepare the technical part of that notice together with your legal team.

Do you work with companies in Leme and the São Paulo countryside?

Yes. MFactor is based in Leme and works with companies in Pirassununga, Araras, Rio Claro, Limeira, Piracicaba, Campinas and all over Brazil. The assessment and most of the work are remote. When the company is in the region and the case calls for it, as in responding to an attack, we come to you.

Contact