ValidaAuditoria
We exercise each feature in the real environment — verified in production, not in a lab.
Every claimed function is executed end to end, in the product running, with the real usage profile.
Permission boundaries tested by the negative: what a role should NOT see, we try to see.
The data that goes in is what persists and comes back — create, reopen and check, never presume.
What underpins the platform — infrastructure, third parties, keys — and what happens when it fails.
The declared processing against the actual flow, operator by operator.
A backup that restores, proven with a date.
What the platform records about who did what — and whether it records at all.
What is exposed on the internet, measured from outside, without intrusion.
Public references, cited as a verification criterion — not as a certification.
Marco Civil da Internet (Brazil's Internet Bill of Rights).
As a control reference, not as a certification.
The most forgotten criterion.
Illustrative example · does not refer to any real development
Claimed"Feature available to all profiles."
Evidence examinedevery function exercised in the product in production, with the real usage profile — including what that profile should not be able to see.
StateVerified what ran in production; Assumed what exists only in a demo.
Caveatdemonstration is not production.
You do not need to have everything. Knowing what is missing is also part of the scope.
No. It is verification of what is claimed, with the real user, without intrusion. The public surface is measured from outside; the rest, with access granted under the letter.
Rarely. It requires access to the product running, with the real profiles.
Same yardstick, relationship declared.
We delimit the object, the applicable criteria and the independence boundary.
Collection and examination of primary data, documents and direct observation.
Confrontation between what is claimed and what is proven, with reality-checks and cross-referencing of sources.
A substantiated report, with explicit caveats — reproducible by a third party.
"Every claim comes out classified: verified or assumed."
Request an audit