Security
How we protect access, digital certificates and data in your NFS-e operations.
Secure connections
Use Corvo’s HTTPS endpoints to protect data transmitted between your application and the API.
Protected certificates
Digital certificates and their passwords are stored using AES-256-GCM encryption. API keys are verified using one-way hashes.
Signed webhooks
Deliveries include an HMAC-SHA256 signature. Verify it on your server before processing the event.
Fiscal document access
XML, PDF and issuance records are stored by workspace and environment. Access requires authentication and permissions.
Permissions and environments
Dashboard access and integration keys follow workspace permissions. Test and production environments are separated.
Data processing
The Privacy Notice and Addendum describe purposes, responsibilities and channels for personal data requests.
Responsible disclosure
Vulnerability reporting
Send reports to security@corvo.tech with reproduction steps and observed impact. Do not include passwords, certificates or third-party personal data.
Suspected unauthorized access
Revoke affected keys, review workspace access and notify the team through the security contact.
Questions about security? security@corvo.tech