LGPD and GDPR in practice: an audit trail of every action, company and per-employee data export, anonymization instead of deletion and private file storage.
What gets recorded
Every action that creates, changes or deletes data enters the audit trail: who did it, when, from where and what changed (previous and new values, when there are any). It can be viewed under Audit by any user with the matching permission and is kept for 365 days by default.
Data subject rights
The company exports its own data under Settings, and each employee's data can be exported from their record as a complete package (personal data, contract, payrolls). A deletion request is fulfilled by anonymization: name, ID and contacts are replaced and the payroll totals keep existing, because the labour and tax obligation to keep payroll does not end with the request.
Where and how data is kept
Data lives in a Postgres database with access restricted to the application; documents and receipts sit in a private bucket and only leave through a signed, time-limited URL after a permission check. No file has a public link. The list of third parties that process data on our behalf is on the Subprocessors page, and the legal basis of each processing activity is in the Privacy Policy.