Brazil security reports

ABCEM is a Brazilian association dedicated to promoting and developing the metal construction industry in Brazil. It serves as a hub for companies, professionals, and institutions involved in metal construction, offering research, advocacy, and professional development courses. The website reflects a well-established organization with a clear market position as a leading industry association. Technically, the website employs a modern technology stack including jQuery, Materialize, and various analytics and marketing tools, providing a good user experience with responsive design and clear navigation. Security posture is adequate with HTTPS and some security headers, but could be enhanced with additional headers and explicit incident response information. Privacy compliance is addressed with a comprehensive privacy policy and cookie consent mechanism. Overall, the website is professional, trustworthy, and serves its target audience effectively.

B

Big Blue

bigblue.com.br

34

Big Blue is a Brazilian IT services company established in 1991, with a strong presence in major Brazilian capitals including São Paulo, Rio de Janeiro, and Belo Horizonte. The company specializes in providing comprehensive IT solutions such as support and monitoring, cloud services, data center moving, network environment management, and structured asset leasing. It maintains strategic partnerships with major hardware manufacturers like IBM, HP, SUN, EMC, and Dell, and offers 24/7 customer support. The website reflects a mature digital presence built on WordPress and Elementor, with a moderate performance profile and good mobile optimization. Security posture is solid with HTTPS and some security headers, though there is room for improvement in privacy compliance and incident response transparency. Overall, the company presents as a credible and established player in the Brazilian technology sector.

N

Natura Brasil

natura.com.br

54

Natura Brasil is a leading enterprise-level retail and e-commerce company specializing in perfumery, makeup, and personal care products. The website showcases a comprehensive product catalog with detailed descriptions, pricing, and promotions, targeting consumers interested in beauty and personal care in Brazil. The technical infrastructure leverages modern technologies such as React, Next.js, and Salesforce Commerce Cloud, supported by robust CDN and analytics tools, ensuring fast performance and excellent mobile optimization. Security posture is strong with HTTPS, security headers, and no visible vulnerabilities, though there is room for improvement in public security policies and incident response transparency. Overall, the site is professional, trustworthy, and compliant with privacy regulations, reflecting a mature digital presence for a well-established brand.

CTF Technologies is a Brazilian company specializing in fleet management and automated payment solutions for businesses. The website reflects the company's rebranding as Sem Parar Empresas, emphasizing its leadership in providing automated toll, fuel, and freight payment services. The site targets companies of various sizes seeking efficient vehicle expense management. Technically, the website uses Bootstrap for responsive design and is protected by Incapsula WAF, indicating a moderate level of security infrastructure. However, there are gaps in privacy compliance and security best practices, such as missing cookie consent mechanisms and incomplete privacy policy links. The absence of visible security headers and incident response information suggests room for improvement in security posture. Overall, the website is functional and professional but would benefit from enhanced privacy and security features to increase trust and compliance.

L

Liberty Mall

libertymall.com.br

37

Liberty Mall is a well-established retail shopping mall located in Brasília, Brazil, operating since 1994. It positions itself as a sophisticated and charming shopping destination offering a variety of retail stores, dining options, health and beauty products, services, and entertainment events. The website reflects a medium-sized business targeting local shoppers and visitors seeking quality shopping and leisure experiences. The company maintains an active social media presence and provides clear contact information, enhancing its market credibility. Technically, the website is built on WordPress CMS with modern plugins and libraries such as WPBakery Page Builder and Flickity Carousel. It uses HTTPS and optimized images but lacks advanced security headers and visible incident response policies. The site is mobile-optimized and provides a good user experience with clear navigation and professional design. However, privacy compliance is weak due to the absence of privacy and cookie policies. From a security perspective, the site has basic HTTPS encryption and no exposed sensitive data but misses important security headers and formal security policies. Tracking via Facebook Pixel is present without a visible cookie consent mechanism, which may raise privacy concerns. The domain registration data is consistent with the business claims, indicating legitimacy. Overall, Liberty Mall's website is professional and credible but would benefit from enhanced security practices and improved privacy compliance to reduce risk and build greater trust with users.

Pint-Pharma is a pharmaceutical company focused on serving patients with rare diseases in Latin America, particularly Brazil. The company emphasizes a community-centric approach and participates in public health consultations, aiming to become a leader in its specialized market segment. The website reflects this positioning with content in Portuguese and links to relevant public health consultation pages. Technically, the site is built on WordPress with Elementor and hosted on a LiteSpeed server. While the site is accessible and well-structured with good design and navigation, there are notable security shortcomings, including the absence of modern TLS protocols and lack of HSTS enforcement. The SSL certificate is valid but the overall SSL/TLS configuration is weak. Privacy compliance is partial, with a cookie consent mechanism present but no visible privacy policy or terms of service. Contact information is limited to a contact form without direct emails or phone numbers. Overall, the site demonstrates moderate digital maturity but requires improvements in security and privacy compliance to enhance trust and protect users.

Food Sabor is a Brazilian company specializing in collective food services, primarily serving institutional markets in the São Paulo region. Their offerings include a variety of meal services such as corporate meals, bulk meals, transported meals, packaged meals, special event catering, coffee breaks, barbecues, and nutritional consultancy. The company positions itself as a quality-focused, socially responsible provider aiming to expand its regional presence. Technically, the website employs a standard modern stack including Bootstrap for responsive design, jQuery for scripting, Font Awesome for icons, and Google services such as Analytics and reCAPTCHA for tracking and security. The site is moderately optimized for mobile devices and has a clear navigation structure, though SEO and accessibility features are basic. From a security perspective, the site uses HTTPS and integrates Google reCAPTCHA to mitigate bot activity. However, it lacks important security headers and does not disclose privacy or cookie policies, which are critical for compliance and user trust. No incident response or security policy information is provided, and no vulnerability disclosures or certifications are visible. Overall, the website is functional and professional but would benefit from enhanced privacy compliance, improved security headers, and clearer communication of security policies to strengthen trust and regulatory adherence.

M

M.J.Prado

mjprado.com.br

32

M.J.Prado is a specialized consulting company focused on asset management and patrimonial reorganization services primarily for Brazilian businesses across various industries such as metallurgy, chemical, telecommunications, and hospitality. The company leverages over 20 years of experience and partnerships with national and multinational firms to deliver comprehensive solutions including inventory management, asset evaluation, and financial reconciliation. The website presents a professional and consistent brand image with clear service offerings and contact channels. Technically, the site uses modern frontend technologies including Bootstrap, jQuery, and integrates Google Analytics and reCAPTCHA for analytics and spam protection. However, it lacks published privacy and cookie policies, and security headers are not detected, which are areas for improvement. The security posture is moderate with HTTPS enabled and secure form handling, but no explicit security or incident response policies are visible. Overall, the website is functional, professional, and trustworthy but would benefit from enhanced privacy compliance and security best practices to improve user trust and regulatory adherence.

POLIZEI Tecnologia is a Brazilian technology consulting and advisory service provider as indicated by the website title and minimal content. The website currently serves primarily as a redirect to a subdirectory, with very limited content and no visible business or contact information. The technical infrastructure is minimal, relying on Google Analytics for visitor tracking but lacking modern security features such as HTTPS and security headers. The site shows basic mobile optimization and accessibility but overall poor design and user experience. Security posture is weak due to absence of HTTPS and security policies, and no privacy or cookie policies are present, indicating poor compliance with data protection regulations. Overall, the website appears to be either under development or a placeholder, limiting its credibility and trustworthiness.

Roland Berger is a well-established global management consultancy with a significant presence in Brazil through its São Paulo office, founded in 1976. The company offers a broad range of consulting services across multiple industries, focusing on corporate performance, digital transformation, and sustainability. The website reflects a professional and consistent brand image targeting business clients seeking expert advisory services. Technically, the site uses modern web technologies including AngularJS, Usercentrics for consent management, Google Tag Manager, and Matomo analytics, hosted behind Cloudflare. However, the security posture is weakened by the lack of a valid SSL certificate and absence of HTTPS enforcement, which is a critical issue for trust and compliance. Privacy compliance is well addressed with clear privacy and cookie policies and consent mechanisms. Contact information is comprehensive and clearly presented, enhancing business credibility. Overall, the site is content-rich and professionally maintained but requires urgent improvements in SSL/TLS configuration to enhance security and user trust.

S

sotreq.com.br

sotreq.com.br

40

Security assessment incomplete. Successfully analyzed: emailSecurity, sslTls, dnsHealth, networkSecurity. Failed to analyze: securityHeaders, gdpr, nis2. 8 security issues were identified in the completed modules. The website may be inaccessible or protected by security measures. Please retry the scan or verify website accessibility.

Security assessment incomplete. Successfully analyzed: emailSecurity, sslTls, dnsHealth, networkSecurity. Failed to analyze: securityHeaders, gdpr, nis2. 10 security issues were identified in the completed modules. The website may be inaccessible or protected by security measures. Please retry the scan or verify website accessibility.

Security assessment incomplete. Successfully analyzed: emailSecurity, sslTls, dnsHealth, networkSecurity. Failed to analyze: securityHeaders, gdpr, nis2. 9 security issues were identified in the completed modules. The website may be inaccessible or protected by security measures. Please retry the scan or verify website accessibility.

Security assessment incomplete. Successfully analyzed: emailSecurity, sslTls, dnsHealth, networkSecurity. Failed to analyze: securityHeaders, gdpr, nis2. 8 security issues were identified in the completed modules. The website may be inaccessible or protected by security measures. Please retry the scan or verify website accessibility.

The website wilsonsons.com.br is currently inaccessible due to a 403 Forbidden error, indicating restricted access or blocking at the server or security layer. This prevents extraction of any meaningful content, metadata, or business information from the site itself. The domain is registered and uses professional DNS and email infrastructure, including Amazon AWS name servers and Google MX servers, suggesting a legitimate and established business presence in Brazil, likely in the transportation sector. The SSL certificate is valid and supports modern TLS protocols, but lacks advanced security features such as HSTS and OCSP stapling. No privacy, cookie, or terms of service policies are detectable on the root page, and no contact information or social media links are present in the accessible content. Overall, the site’s security posture is basic but could be improved with additional headers and DNS security measures. Due to the blocked content, the overall risk assessment is limited and the AI scoring is low, reflecting the inability to fully evaluate the site’s content and compliance.

D

Ditech

ditech.com.br

24

Ditech is a Brazilian technology company founded in 2001 specializing in custom software development, IT outsourcing, and consulting services. The company targets businesses seeking tailored technology solutions and has an established market presence supported by a portfolio of client cases and active social media engagement. The website is built on WordPress with several plugins including Yoast SEO and HubSpot integration, indicating a moderate level of digital maturity. However, the site lacks HTTPS, which is a critical security shortfall, and uses outdated libraries that may expose it to vulnerabilities. No privacy or cookie policies are published, reflecting gaps in compliance. Overall, while the business appears legitimate and professional, the security posture requires urgent improvement to protect user data and enhance trust.

C

Comunica PR Assessoria de Imprensa

comunicapr.com

37

Comunica PR Assessoria de Imprensa is a small Brazilian public relations and digital marketing agency specializing in press advisory, social media management, influencer marketing, and media kit production. The company targets businesses in Brazil seeking personalized communication solutions to enhance their brand presence. The website is built on the Wix platform, utilizing modern technologies such as React 18 and Wix's proprietary components, indicating a moderate level of digital maturity. However, the absence of a valid SSL certificate and serving the site over HTTP only is a significant security concern. While basic security headers like HSTS and X-Content-Type-Options are present, the lack of HTTPS reduces the overall security posture. The site includes Google Ads and Analytics for marketing and tracking, with a cookie consent mechanism in place, but lacks an explicit privacy policy and terms of service, which are important for compliance. Contact information is clearly provided, including company emails, phone numbers, and a physical address, supporting business credibility. Overall, the site is professionally designed with good content relevance and navigation but requires urgent security improvements to protect user data and enhance trust.

The website arionsolutions.com.br is currently inactive and displays an error page indicating that the site does not exist or the content has been removed. The page promotes Locaweb's site creation service as an alternative. There is no substantive business information, contact details, or privacy and security policies available on the site. Technically, the site is served via HTTP without SSL/TLS encryption, which is a critical security deficiency. Basic security headers are present but insufficient to ensure a strong security posture. DNS and mail records indicate hosting and mail services are provided by Locaweb, a known Brazilian hosting provider. Overall, the site lacks content, security, and compliance features, resulting in a low trust and credibility score.

Security assessment incomplete. Successfully analyzed: emailSecurity, sslTls, dnsHealth, networkSecurity. Failed to analyze: securityHeaders, gdpr, nis2. 7 security issues were identified in the completed modules. The website may be inaccessible or protected by security measures. Please retry the scan or verify website accessibility.

The website for einstein.br, representing Hospital Israelita Albert Einstein, is currently inaccessible due to a Web Application Firewall (WAF) or security mechanism blocking access. The page returns an 'Access Denied' message with minimal HTML content, preventing extraction of meaningful metadata, business information, or contact details. The DNS configuration indicates the use of Akamai CDN services and multiple mail servers, consistent with a large healthcare organization in Brazil. However, the SSL/TLS configuration is severely lacking, with no valid certificate or modern TLS protocols enabled, exposing the site to security risks. Overall, the website's digital presence is hindered by these security and accessibility issues, limiting user trust and engagement.

Security assessment incomplete. Successfully analyzed: emailSecurity, sslTls, dnsHealth, networkSecurity. Failed to analyze: securityHeaders, gdpr, nis2. 13 security issues were identified in the completed modules. The website may be inaccessible or protected by security measures. Please retry the scan or verify website accessibility.

ReSound Brazil, operated under the global GN Hearing A/S brand, specializes in manufacturing and retailing advanced hearing aids and wireless accessories. The website targets Brazilian consumers and hearing professionals, offering product information, support, and professional services. The company is well-established with a history dating back to 1943 and maintains a strong market position in the healthcare sector. Technically, the website employs modern web technologies including Google Tag Manager and Cookiebot for analytics and consent management, hosted likely on Microsoft Azure infrastructure. However, a critical security gap exists due to the absence of a valid SSL certificate and HTTPS support, exposing users to potential risks. Privacy and cookie policies are comprehensive and GDPR compliant, enhancing user trust. Overall, the site is professional and user-friendly but requires urgent security improvements to protect user data and maintain credibility.

Ingraphics Soluções & Imagens is a small digital marketing agency based in the ABC region of São Paulo, Brazil. The company offers a range of services including digital marketing, web design, graphic design, illustration, and campaign management. Their website demonstrates a professional approach with clear service offerings and client testimonials, targeting businesses seeking to improve their digital presence and marketing effectiveness. Technically, the website is built on WordPress using Elementor and integrates marketing tools such as ActiveCampaign and Yoast SEO, indicating a moderate level of digital maturity. However, the absence of a valid SSL certificate and HTTPS support is a critical security gap that undermines user trust and data protection. Privacy policies and cookie consent mechanisms are present but basic, with no explicit GDPR compliance or incident response information. Overall, the site is functional and informative but requires urgent security improvements to meet modern standards.

G

Grupo Soma

somagrupo.com.br

58

Grupo Soma is a large Brazilian retail group operating a platform of multiple fashion brands including Animale, Farm, and Hering among others. The website serves as a corporate and investor relations portal, providing information about the company, its brands, sustainability efforts, and compliance policies. The target audience includes consumers and investors interested in the fashion retail sector in Brazil. Technically, the website is built on WordPress and uses modern JavaScript libraries and Google Analytics for tracking. However, the site lacks a valid SSL certificate and does not serve content over HTTPS, which is a significant security concern. Security headers are partially implemented but critical TLS protocols and HSTS are missing, reducing the overall security posture. Privacy compliance is well addressed with a comprehensive privacy policy and cookie consent mechanism via OneTrust. Business credibility is supported by clear brand listings and compliance pages but lacks explicit contact emails or phone numbers on the homepage. Overall, the site is functional and professional but requires urgent security improvements to protect user data and enhance trust.

Vaticano Imóveis is a well-established real estate agency based in Curitiba, Brazil, with over 30 years of market presence. The company specializes in property sales, rentals, and digital rental services, targeting families and individuals seeking real estate opportunities in Curitiba and surrounding areas. Their business model leverages digital marketing and advanced management strategies to maintain a competitive edge in the local market. The website reflects a professional and consistent brand image with comprehensive service offerings and clear contact channels. Technically, the site is built on the Kenlo CMS platform, utilizing modern web technologies such as Marko.js, Google Tag Manager, and Matomo analytics. However, the absence of a valid SSL certificate and HTTPS support is a critical security flaw that undermines user trust and data protection. Privacy and cookie policies are well implemented, demonstrating good compliance with data protection regulations. Overall, the site is functional and user-friendly but requires urgent security improvements to meet modern standards.

Security assessment incomplete. Successfully analyzed: emailSecurity, sslTls, dnsHealth, networkSecurity. Failed to analyze: securityHeaders, gdpr, nis2. 8 security issues were identified in the completed modules. The website may be inaccessible or protected by security measures. Please retry the scan or verify website accessibility.

C

Cia. Hering

ciahering.com.br

40

Cia. Hering is a well-established Brazilian retail clothing franchise network with a strong market position as the largest clothing franchise in Brazil. The company operates an omnichannel business model, combining physical stores and e-commerce to provide convenience to its customers. The website reflects a professional corporate presence with multilingual support and investor relations information, indicating a mature business. Technically, the site is built on WordPress and uses common web technologies and services such as Cloudflare CDN and OneTrust for cookie consent. However, the site lacks a valid SSL certificate and proper HTTPS configuration, which is a critical security issue. Security headers are present but cannot compensate for the missing SSL. Privacy compliance is partial, with a cookie consent mechanism but no visible privacy policy or terms of service. Overall, the site demonstrates good business credibility but requires urgent security improvements to protect user data and enhance trust.

Lulufantasias.com.br operates as a virtual companionship service targeting Portuguese-speaking users, primarily in Brazil. The service offers intimate conversational experiences via WhatsApp, leveraging subscription plans with message limits and conversation memory. The business is operated by Stripeless Zebra LLC and DA Industries OU, indicating a small but focused operation. Technically, the website is built on WordPress with common plugins and hosted behind Cloudflare DNS services. However, the lack of a valid SSL certificate and absence of HTTPS significantly undermines the security posture. Privacy policies and terms of service are present but basic, with no cookie consent mechanisms detected. Overall, the site presents a professional and consistent brand experience but requires urgent security improvements to protect user data and build trust.

The website leismunicipais.com.br is currently inaccessible due to a Cloudflare security challenge page requiring human verification before access. This prevents retrieval of any meaningful business or content data. The domain is registered and hosted via Cloudflare with DNS and email services configured, but no SSL certificate is present, resulting in no HTTPS support. The site lacks any visible privacy, cookie, or terms of service policies, and no contact information or business details are available. Performance is slow, and the site appears to be in a blocked or pre-access state rather than serving actual content.

Security assessment incomplete. Successfully analyzed: emailSecurity, sslTls, dnsHealth, networkSecurity. Failed to analyze: securityHeaders, gdpr, nis2. 10 security issues were identified in the completed modules. The website may be inaccessible or protected by security measures. Please retry the scan or verify website accessibility.

The website medcel.com.br is currently inaccessible due to a Cloudflare Web Application Firewall (WAF) block, presenting a security challenge page instead of actual content. This prevents any meaningful extraction of business, privacy, or security policies and limits the ability to assess the website's digital maturity or business model. The DNS configuration shows use of Cloudflare for DNS and protection, and Microsoft Outlook for email services, with proper SPF and DMARC records indicating good email security practices. However, the SSL/TLS configuration is critically lacking, with no valid certificate and no TLS protocols enabled, resulting in a poor security posture. Performance metrics indicate very slow load times and minimal resource delivery, likely due to the block page. Overall, the website's security posture is weak due to missing HTTPS and the presence of a blocking WAF, and the content quality and business credibility cannot be assessed due to lack of access.

M

Medical Harbour

medicalharbour.com

60

Medical Harbour is a Brazilian technology company specializing in medical imaging solutions, including software for radiology, teleradiology, and medical education. Their product portfolio includes advanced DICOM viewers, cloud PACS solutions, and educational tools such as virtual cadaver and anatomical atlases. The company targets hospitals, clinics, radiologists, and medical educators, positioning itself as a niche specialist in healthcare technology. The website is professionally designed, multilingual, and integrates modern marketing and analytics tools, although it suffers from slow performance and lacks a valid SSL certificate, which is a critical security concern. Despite strong email security policies like SPF and DMARC, the absence of HTTPS and modern TLS protocols significantly weakens the security posture. Privacy compliance is well addressed with clear privacy and cookie policies and consent mechanisms. Overall, Medical Harbour demonstrates a solid business presence with room for improvement in technical and security infrastructure.

A

Afya Participações S.A

afya.com.br

72

Afya Participações S.A operates as the largest hub for medical education and digital solutions in Brazil, targeting medical students, professionals, and healthcare providers. The company offers a broad portfolio including undergraduate medical courses, postgraduate education, continuing medical education, and digital health solutions. It holds a strong market position with over 20,000 medical students and multiple subsidiaries and partners enhancing its ecosystem. Technically, the website is built on Webflow, hosted via Cloudflare, and integrates modern analytics and marketing tools, demonstrating a mature digital infrastructure with fast performance and good mobile optimization. Security posture is solid with HTTPS, strong security headers, and cookie consent mechanisms, although improvements in HSTS and vulnerability disclosure could be made. Privacy compliance is well addressed with comprehensive policies and consent management. Overall, the website reflects a professional, trustworthy, and well-managed digital presence aligned with its enterprise scale and sector focus.

M

Madri Lab

madrilab.com.br

40

Madri Lab is a Brazilian company specializing in multimedia services with a strong focus on educational technology, particularly hosting and customizing Moodle-based EAD platforms. Their market position is that of a niche service provider offering tailored solutions for educational institutions and corporate clients seeking to enhance their online learning environments. The website demonstrates a professional approach with good content quality and clear navigation, targeting Portuguese-speaking audiences in Brazil. Technically, the site is built on WordPress with Elementor and Yoast SEO, but lacks critical security features such as HTTPS, which significantly impacts its security posture. The absence of an SSL certificate and security headers exposes the site to risks and undermines user trust. Privacy compliance is basic, with privacy and terms pages present but no cookie consent mechanism detected. Overall, the site is functional and informative but requires urgent security improvements to protect user data and enhance credibility.

E

Expert EAD

aulaoead.com.br

47

Expert EAD is a specialized online education platform focused on LMS Moodle training, offering a comprehensive catalog of over 30 courses ranging from beginner to advanced levels. The platform targets educators, LMS administrators, developers, and IT professionals, providing certification and practical learning outcomes. The website is built on WordPress with Elementor and integrates marketing and analytics tools such as Google Analytics and Facebook Pixel. However, the site lacks a valid SSL certificate and does not serve content over HTTPS, which is a critical security concern. Cookie consent mechanisms are implemented, but privacy policies and terms of service are not found, indicating potential compliance gaps. Business information is clearly presented, including parent company details and social media presence, enhancing credibility.

A

Agritech Lavrale S.A. - Divisão Lavrale

lavrale.com.br

40

Agritech Lavrale S.A. - Divisão Lavrale is a Brazilian manufacturing company specializing in agricultural machinery and components, with a legacy of approximately 50 years. The company offers a broad range of products including agricultural implements, cabines, military trailers, and spare parts, targeting agricultural workers and farmers. Their market position is established with a consistent brand presence and active social media engagement. Technically, the website is built on a custom or unknown CMS, served by an Apache server, and uses common web technologies such as JavaScript, Google Fonts, and Google Maps API. However, the site lacks HTTPS, which severely impacts its security posture. Security headers are minimal and some are disabled, indicating a need for significant improvements in security practices. Privacy and cookie policies are absent, which raises compliance concerns. Overall, the website provides good content quality and user experience but suffers from critical security and privacy shortcomings.

L

Lintec Ind. Com. de Motores e Equip. Movim. Materiais Ltda.

lintecmotores.com.br

40

Lintec Motores is a Brazilian company specializing in the manufacturing and distribution of energy generators, including diesel and gasoline models, as well as related equipment such as motobombas and motors. It operates as a subsidiary of Agrale S.A., leveraging the parent company's certification and quality standards to position itself as a provider of cost-effective and robust energy solutions primarily for the Brazilian market. The website serves as a platform for product information, distributor location, and post-sales support, targeting customers seeking reliable energy generation equipment. Technically, the website employs a traditional technology stack including nginx web server, jQuery libraries, Google Analytics, and Google reCAPTCHA for form security. However, it lacks modern security implementations such as HTTPS, valid SSL certificates, and advanced security headers, which exposes users to potential risks. The site shows basic mobile optimization and accessibility features but suffers from slow performance and outdated libraries. From a security perspective, the absence of HTTPS and TLS protocols is a critical vulnerability. While the site includes comprehensive privacy and cookie policies compliant with GDPR principles, it lacks explicit terms of service, security policies, and incident response contacts. The cookie consent mechanism is implemented via Popupsmart, providing users with control over cookie preferences. Overall, the security posture is weak and requires urgent improvements to protect user data and enhance trust. The overall risk assessment indicates a medium risk level due to missing HTTPS and outdated technologies. Strategic recommendations include immediate SSL implementation, upgrading security headers, modernizing the tech stack, and enhancing transparency with clear security and incident response policies to improve user trust and compliance.

B

BCS Eventos

bcseventos.com.br

45

BCS Eventos is a Brazilian company specializing in intelligent solutions for events such as fairs, congresses, and shows. Established in 1997, it has served over 1,000 events and offers a comprehensive event management platform called SIGEVENT, alongside technical support and equipment rental services. The company targets event organizers and managers, positioning itself as an experienced and reliable provider in the event technology sector. Technically, the website is hosted on KingHost with an Apache server and uses modern JavaScript libraries and Google Fonts, but lacks HTTPS security and advanced security headers. The site is professionally designed with good content quality and navigation, though performance data is limited. Security posture is weak due to missing SSL certificate and security headers, posing risks to user data and trust. Privacy compliance is basic with a privacy policy present but no cookie consent mechanism. Overall, the website is functional and professional but requires significant security improvements to enhance trust and compliance.

A

Attention Required! | Cloudflare

argoenergia.com.br

30

The website argoenergia.com.br is currently inaccessible due to a Cloudflare Web Application Firewall (WAF) blocking page, preventing access to any substantive content. As a result, no direct business information, metadata, or contact details are available for analysis. The domain is associated with the energy sector in Brazil based on the domain extension and DNS records, but no further business insights can be derived from the blocked content. The technical infrastructure includes Cloudflare protection, a valid SSL certificate with basic configuration, and DNS records with SPF and DMARC policies indicating some email security measures. However, the absence of DNSSEC and CAA records suggests room for improvement in DNS security. Performance metrics indicate a slow load time, likely due to the WAF challenge page. Security posture is moderate due to HTTPS and email authentication but lacks advanced security headers and HSTS enforcement. Overall, the site’s security and compliance posture cannot be fully assessed due to the blocking mechanism.

I

Insany Design

insanydesign.com

54

Insany Design is a Brazilian design, technology, and innovation studio established in 2016, specializing in enhancing digital presence for brands through web development, e-commerce, and digital product solutions. The company positions itself as a creative and technical partner for businesses seeking to transform their digital experiences. The website reflects a professional and consistent brand image with extensive case studies and client logos, targeting businesses looking for innovative digital solutions. Technically, the site is built on modern frameworks such as Next.js and hosted on Vercel, utilizing React and other contemporary technologies. However, the site suffers from a critical security issue due to an invalid SSL certificate and lack of modern TLS protocol support, which undermines user trust and security. Privacy compliance is minimal, with no visible privacy or cookie policies, and no GDPR indicators. Overall, the site is content-rich and professionally designed but requires urgent security and privacy improvements to meet industry standards.

S

Start EAD

startmoodle.com

40

Start EAD is a Brazilian SaaS platform offering a fully customizable virtual store integrated with the Moodle LMS for online course sales and management. The platform targets content creators, educators, and entrepreneurs seeking control over their EAD projects without high platform commissions. Technically, the site is built on WordPress with Elementor and uses various plugins for SEO and marketing. However, the site lacks HTTPS, which severely impacts its security posture. Marketing tools like Facebook Pixel and Google Tag Manager are used, but privacy and cookie policies are absent, indicating compliance gaps. Overall, the business presents a professional front with good content and user experience but requires urgent security and privacy improvements.

S

Start EAD

startead.com.br

40

Start EAD is a Brazilian SaaS platform focused on providing a comprehensive and customizable online course store integrated with the Moodle LMS. It targets content creators, educators, and entrepreneurs in the distance learning market, offering automated enrollment, payment integration, and technical support. The website is built on WordPress using Elementor and Astra theme, with modern UI elements and social media integration. However, the site lacks a valid SSL certificate, serving content over HTTP, which significantly impacts its security posture. No privacy or cookie policies were found, indicating potential compliance gaps. The business presents clear subscription plans and customer testimonials, reflecting moderate trustworthiness and professionalism.

A

AGRALE S.A

agrale.com.br

45

Agrale S.A is a well-established Brazilian manufacturer specializing in tractors, trucks, buses, utility vehicles, and engines with over 50 years of market presence. The company operates primarily in the transportation sector, serving agricultural, commercial, and industrial clients through a broad dealer and service network. Their website reflects a solid business model focused on manufacturing and after-sales services, targeting national and regional markets in Brazil. The site content is relevant and professionally presented, supporting the company's market position as a national leader. Technically, the website uses an older technology stack including jQuery 1.7.1 and Apache server on Ubuntu, hosted via Embratel Cloud DNS infrastructure. While the site includes Google Maps integration and FontAwesome icons, it lacks modern CMS or frameworks and shows signs of technical debt such as outdated libraries and missing HTTPS support. Performance and mobile optimization are basic, with room for improvement in SEO and accessibility. From a security perspective, the site lacks a valid SSL certificate and does not support HTTPS, severely impacting its security posture. No advanced security headers or mechanisms like HSTS or OCSP stapling are implemented. The site uses standard security headers but misses critical protections and vulnerability disclosures. Privacy and cookie policies are present with a consent mechanism, but GDPR compliance is uncertain. No incident response or security policy pages were found. Overall, the website is functional and business-credible but requires urgent security improvements, especially enabling HTTPS and updating outdated technologies. Strategic recommendations include implementing a valid SSL certificate, enhancing security headers, publishing vulnerability disclosure policies, and modernizing the technical stack to improve performance, security, and compliance.

A

Acrilys

acrilys.com.br

60

Acrilys is a Brazilian manufacturing company specializing in plastic technologies, particularly injection molding and vacuum forming with proprietary tooling. The company emphasizes sustainability and ecological awareness, investing in people and technology to deliver innovative and efficient solutions. Their market position is strengthened by certifications such as ISO 9001:2015 and IATF 16949:2016, indicating a commitment to quality and automotive industry standards. The website targets industrial clients and businesses requiring plastic manufacturing services, primarily in Brazil. Technically, the website is built on Webflow CMS, hosted and served via Cloudflare, and uses modern web fonts and libraries. However, the site lacks a valid SSL certificate and proper HTTPS configuration, which is a critical security flaw. The presence of a cookie consent mechanism and privacy policy indicates some privacy compliance, though GDPR compliance is not fully evident. Overall, the security posture is weak due to missing SSL and lack of incident response information. The website is professionally designed with good content quality and navigation but requires urgent security improvements to protect user data and enhance trust.

Aerolux is a small Brazilian business specializing in road signaling products for the Brazilian market. The website is currently a 'Coming soon' placeholder with minimal content, indicating the business is either new or preparing for a launch. The site targets businesses or entities needing road signaling solutions in Brazil. Technically, the site is built using Hostinger Website Builder and the Astro framework, hosted on Hostinger's GCP infrastructure. However, the site lacks a valid SSL certificate and does not serve content over HTTPS, which is a critical security deficiency. Security headers are partially implemented, but key security features like TLS protocols and OCSP stapling are missing. Privacy and cookie policies are absent, and no incident response or vulnerability disclosure information is provided. Overall, the site demonstrates basic digital maturity but requires significant improvements in security and compliance to build trust and protect user data.

Y

YourWay Digital

yourway.digital

50

YourWay Digital is a Brazilian digital agency specializing in custom development of applications, websites, and digital marketing services. Established in 2019 and based in Caxias do Sul, Brazil, the company has delivered over 70 projects and holds a Platinum partnership with RD Station, highlighted by winning the Limitless RD Station 2024 award. The website showcases a comprehensive portfolio of services including app development, marketing strategy, site creation, e-commerce solutions, social media management, and branding. Technically, the site is built on modern frameworks such as Next.js and React, hosted on Vercel, and integrates with AWS and Heroku platforms. However, the site lacks a valid SSL certificate, resulting in no proper HTTPS support, which is a critical security concern. Security headers are present but the SSL/TLS configuration is incomplete, exposing the site to potential risks. Privacy compliance is minimal with no visible privacy or cookie policies, though SPF and DMARC DNS records are properly configured for email security. Overall, the website is professionally designed with excellent content quality and user experience, but security and privacy practices require urgent improvement to enhance trust and compliance.

A

AKZONOBEL LTDA.

coralmatiz.com.br

46

Coral Matiz is a Brazilian loyalty and professional engagement platform operated by AKZONOBEL LTDA., targeting architects, interior designers, and landscapers. The platform offers curated content, professional tools, and a points-based rewards program to enhance user engagement and brand loyalty. The website is well-branded and content-rich, with clear navigation and a focus on professional users and students in the design sector. Technically, the site uses a modern front-end stack including Bootstrap, jQuery, and integrates Google Analytics and Tag Manager for tracking. However, the absence of a valid SSL certificate and HTTPS support significantly undermines the security posture, exposing users to risks when submitting sensitive personal data. Privacy and cookie policies are comprehensive and GDPR/LGPD compliant, with consent mechanisms implemented. Overall, the site demonstrates good business credibility but requires urgent security improvements to protect user data and comply with best practices.