LGPD

Overview

LGPD is Brazil’s primary data protection law governing the processing of personal data, including requirements related to transparency, lawful processing, data subject rights, security safeguards, vendor oversight, and international data transfers. For Xano as a SaaS platform provider, LGPD alignment means maintaining privacy, security, and contractual controls designed to support customers that process personal data through the Xano platform. For customers as controllers, this helps demonstrate that the underlying platform can support regulated data processing activities; however, customers remain responsible for determining their lawful basis, configuring their applications appropriately, managing end-user notices and consents where required, and fulfilling their own LGPD obligations.

How Xano Aligns With Criteria

Xano maintains a range of contractual documents, policies, procedures, and operational controls to support its alignment and overall security posture. The examples below highlight key elements of our program in relation to LGPD requirements, and do not represent a complete list:

• Data Processing Addendum (DPA) - available to all paid plans (excluding Free plan), please request a DPA by emailing us at security@xano.com
• Subprocessor list - available here (https://docs.xano.com/legal/xano-subprocessors)
• Privacy Notice - available here (https://docs.xano.com/legal/privacy-notice)
• Information Security Policy
• Privacy & Data Protection Policy
• Access Control Policy
• Incident Response Procedure
• Data Subject Access, Correction, & Erasure Request Procedure
• Disaster Recovery Procedure