Security, Privacy and Responsible AI
Trust is one of Upskill's pillars. Our platform was built to support leadership development while preserving the confidentiality of information, protecting personal data, and adopting modern security, governance and responsible Artificial Intelligence practices.
We serve organisations in Brazil, Portugal, Panama, Costa Rica and Guatemala, following applicable data protection legislation and maintaining an ongoing program to evolve our security and privacy practices.
Privacy
We collect only the data we need and apply limited retention to protect the confidentiality of information.
Security
Modern authentication controls, encryption, segregation between clients, auditing and continuous monitoring.
Responsible AI
Artificial Intelligence specialised in the Upskill methodology, used transparently, configurable, and never trained on client data.
Compliance
Governance aligned with the leading data protection regulations and international information security best practices.
How we protect what matters
Privacy by Design
Data protection is part of the platform's architecture from its conception. We process only the data necessary to provide the contracted services. We apply the principles of:
- Data minimization
- Limited retention
- Need-based access
- Segregation between clients
- Transparency in processing
- Continuous improvement of security controls
Information Security
The platform's security combines technical, administrative and organisational controls to protect the confidentiality, integrity and availability of information. All access follows the principle of least privilege: each user accesses only the information necessary to perform their role. Measures adopted include:
- Multi-factor authentication (MFA)
- Single Sign-On (SSO), when contracted
- Encrypted communication
- Encryption of data at rest and of backups, as applicable
- Role-based access control
- Logical segregation between organisations
- Audit logs
- Operational monitoring
- Formal incident response policies
- Periodic review of security controls
Confidentiality of Sessions
Confidentiality is essential to effective mentoring. Information produced during the development process belongs to the participant and the contracting organisation, within the limits contractually defined. Client-company administrators have access only to the management-level information needed to track the program, with no access to the private content of individual sessions. The platform keeps only the structured records needed for the continuity of the development journey, reducing the retention of temporary information.
Responsible Artificial Intelligence
Upskill's Artificial Intelligence was built to expand the quality, consistency and scalability of leadership development. It draws on a proprietary knowledge base built from the Upskill methodology, continuously enriched by our specialists.
Depending on the contracted model, the AI can act as:
- A digital mentor specialised in the Upskill methodology
- Operational support to human mentors during individual development processes
In one-on-one mentoring, the AI helps organize information, structure follow-up and generate development suggestions, freeing up the mentor's time for decisions, strategic conversations and the relationship with the mentee. Regardless of the model used, the AI operates within the limits set by the methodology and by the configurations contracted by the client.
Our commitment to AI
The platform was built following responsible AI principles. The AI:
- Supports human development
- Uses only the information necessary for each interaction
- Does not use client data to train models
- Operates under specific privacy and security controls
- Can be configured according to each organisation's needs
The contracting organisation can set different levels of AI usage according to its internal policy.
Data Protection
When a session uses audio processing or transcription features, that information is kept only for as long as needed to ensure processing quality, recovery in case of technical failures, and operational support.
After that period, the platform keeps only the structured information needed for the continuity of the participant's development, such as:
- Development topics
- Action plans
- Missions
- Next steps
- Follow-up points
The platform does not use full transcripts as a permanent record of mentoring.
Transparency
We maintain a set of governance policies and documents to support clients during vendor approval, audit and due diligence processes. These include:
- Privacy Policy
- Data Processing Agreement (DPA)
- Data Retention Policy
- Subprocessor List
- Access Control Policy
- Security Overview
- Responsible AI Policy
- Incident Response Plan
Additional technical documentation can be made available to corporate clients upon evaluation and, where applicable, a confidentiality agreement.
Compliance
Our governance considers requirements and best practices related to:
- The General Personal Data Protection Law (LGPD — Brazil)
- The General Data Protection Regulation (GDPR — European Union), when applicable
- Law 81 of 2019 (Panama)
- Law 8968 on the Protection of Individuals with Regard to the Processing of Personal Data (Costa Rica)
- International information security and privacy best practices
Our governance program is continuously reviewed to keep pace with technological and regulatory developments and market best practices.
Data Residency and Processing
Upskill uses global cloud infrastructure providers to ensure performance, availability and operational resilience.
When required by regulatory or contractual requirements, specific data residency configurations can be made available for certain regions. International data transfers are carried out only when necessary to perform the contracted services and observe the applicable legal mechanisms.
Security in Continuous Evolution
Security is not a finished project, but an ongoing process. Upskill continuously reviews its technical controls, internal policies and operating processes to keep pace with evolving threats, regulations and client expectations.
Our goal is to offer a trustworthy platform for organisations that want to develop leaders responsibly, privately and securely.
For corporate clients and vendor approval processes
We make specific documentation available upon request.
Public documentation
- Privacy Policy
- Trust Center
- Subprocessor List
- Responsible AI Policy
- Data Processing Agreement (template)
Documentation for clients and audits
- Security Overview
- Data Retention Policy
- Access Control Policy
- Incident Response Plan
- Record of Processing Activities (ROPA)
- Governance reports and evidence, where applicable
If your organisation has specific requirements for security, privacy, data residency or regulatory compliance, our team can support the technical and legal evaluation process during contracting.
Need to validate
our security?
Talk to our team for a technical assessment, due diligence, or questions about privacy and AI.
Talk to our team