Security

Protecting member accounts and data is central to how we build and operate Metropolle. Access to our systems is monitored and recorded. Security events are investigated and, when required, reported to the competent authorities.

Security Lead: Daniel Teodoro, Founder, is responsible for Metropolle's internal platform security. Contact: contact form.

This page describes how the platform may be used, how to report a vulnerability, and the main legal framework that applies to computer systems. It complements our Terms of Use and Privacy Policy.

Metropolle may be used only through its public interfaces (the website and the applications we provide), with your own account. The following activities are not authorized:

• Probing, scanning or load-testing our systems;
• Guessing or testing credentials, or accessing an account that is not yours;
• Using invite codes that were leaked or that belong to someone else;
• Attempting to access non-public areas, interfaces or data.

If you believe you have found a security vulnerability in Metropolle, we would like to hear from you. Good-faith reports that follow the guidelines below are welcome.

Send your report through our contact form (with the security inquiry subject prefilled) and include, where possible:

• A description of the issue and its potential impact;
• The affected page, feature or endpoint;
• Steps to reproduce the issue;
• How we can reach you for follow-up questions.

This channel is for reporting issues you come across while using the platform normally. Security testing is not authorized without our prior written permission — if you would like to test, write to us first. When reporting, do not access, modify or delete data that belongs to others, and give us reasonable time to address the issue before disclosing it publicly. We will acknowledge your report and keep you informed as we investigate.

For general information, these are some of the main laws that address unauthorized access to computer systems and the protection of personal data:

Brazil

• Law No. 12.737/2012, which added article 154-A (invasion of a computer device) to the Brazilian Penal Code, with penalties increased by Law No. 14.155/2021;
• Law No. 13.709/2018 (LGPD, General Data Protection Law);
• Law No. 12.965/2014 (Marco Civil da Internet), under which covered application providers keep access logs confidentially for a set period (article 15) and make them available only under a court order.

International

• The Council of Europe Convention on Cybercrime (Budapest Convention), to which Brazil acceded in 2022.

United States

• Computer Fraud and Abuse Act (18 U.S.C. § 1030).

Other jurisdictions have equivalent laws. This section is informational only and is not legal advice.

For security matters, use our contact form.