Compliance and Data Governance

Data philosophy

At CPFHub.io, information security and privacy are treated as interdependent. The platform was built on the concept of Privacy by Design, ensuring that every technical decision respects the integrity of personal data from the start. We are identity validation and fraud prevention infrastructure: we do not sell lists, we do not provide data for marketing and we do not operate as a data broker.

Legal structure of processing

CPFHub.io acts in distinct roles under the LGPD (Brazil's data protection law), arts. 5, 39 and 42:

CPFHub.io as Controller

CPFHub.io is the Controller of the registration, billing and platform usage data provided by Customers, and of its validation database, made up of data licensed from private providers and of official public sources, used exclusively for identity validation and fraud prevention.

CPFHub.io as Processor

When running each lookup sent by a Customer, CPFHub.io acts as Processor, following the Customer's instructions. In this context, the Customer is the Controller and is responsible for the legal basis of each lookup toward its users.

Legal bases applicable to API lookups

The legal basis for each lookup is determined by the Customer according to its purpose. The most common bases are:

• Legitimate Interest (art. 7, IX): fraud prevention and transaction security, when the interests of the controller or of the data subject themselves outweigh the risks to the data subject.
• Compliance with a legal or regulatory obligation (art. 7, II): when the Customer is required by a rule of its sector to identify customers, such as financial institutions, betting operators and other regulated anti-money laundering activities.
• Performance of a contract (art. 7, V): when identity verification is a necessary step in formalizing a contractual relationship with the data subject.

Necessity and minimization principle (art. 6, III)

The API returns only the biographical data needed to confirm identity: name, date of birth and gender, and, in the Real-Time Lookup, the registration status and the indication of death. We do not return sensitive, financial, address or location data.

Compliance with the Felca Law (Law 15.211/2025)

Law 15.211/2025 (“ECA Digital”, Brazil's digital child protection law) sets age verification obligations for digital platforms with content or services unsuitable for minors. When you use CPFHub.io in this flow, compliance with the law is handled by your platform, and we provide the data and supporting documentation. In practice, this involves:

• combining the CPF lookup with a way to confirm that the user is the owner of the CPF,
• obtaining the consent of the legal guardian when necessary (LGPD, art. 14),
• documenting the measures taken, for accountability.

CPFHub.io provides the verification data. The decision to grant access to the user or not rests with your platform.

Retention and transparency

Each type of data has its own retention period, described in the Privacy Policy: the lookup history follows the life of the account, technical and access records are kept for up to 12 months and Real-Time Lookup proofs for up to 5 years. At the end of these periods, the data is deleted or anonymized.

Security measures

• API and validation database hosted in Brazil.
• Encryption in transit (TLS 1.2 or higher) and infrastructure with encryption at rest.
• Individual API key per Customer and the principle of least privilege for the team.
• Usage limits per account, signup checks and abuse-blocking mechanisms.
• Audit records of administrative operations and periodic access reviews.

DPO communication channel

Under art. 41 of the LGPD, CPFHub.io's Data Protection Officer (DPO) is Bernardo Rocha, who can be contacted by email at dpo@cpfhub.io. Data subjects, including people whose CPF was looked up, can use this channel to exercise their rights. We reply within 15 days.