Security and compliance
Your legal team approves the rules once. After that, the board publishes every week.
Every answer legal, InfoSec and procurement usually ask for: authorship, account access, ownership of the content, LGPD and contracting. Already in writing, ready to forward.
Legal
Who decides what can and cannot be published?
Your company. At setup we turn your legal team's restrictions into checkable rules, and the check runs against those rules before every publication. We do not apply a standard of ours over yours.
Who is the author of the content?
The executive. He approves the angle before any text exists, and approves the finished piece before it goes out. Nothing is published automatically.
If a checked piece turns into a problem, who answers for it?
Your company, because your company approves it and your company publishes it: the publish button is always on your side. Our part is reducing the chance the problem gets that far — every piece is scored against the rules your legal team approved, and anything below the agreed threshold does not go through to approval. It is in the contract, and we say it before signature.
Who owns the content produced?
The client. The archive, the editorial line and each executive's voice guide are yours, and they leave with you if the contract ends.
What happens if an executive leaves the company?
Content already published stays on his personal profile, as it always was. The seat in the programme can be transferred to another executive within the contract, and the departing executive's voice guide is not reused.
Is there a record of who approved what?
Yes. Every piece carries the history: the angle proposed, the executive's approval, the compliance check result and the publication timestamp.
Information security
Do you ask for the executive's LinkedIn password?
Never. We publish through the official LinkedIn publishing API: the executive grants the authorisation inside LinkedIn itself and can revoke it at any moment, without going through us. There is no credential in play, at any point in the process.
What does the authorisation give access to?
Publishing on his behalf and reading the metrics of those posts. That is all. Private messages, his network of contacts and the company's corporate account are outside the scope of the authorisation.
What company data do you store?
Each executive's immersion material, the editorial line, the compliance rules your legal team approved, and the publication history. None of it is used to train third-party models.
Will you sign a DPA and complete a security questionnaire?
Yes, both. The DPA and the pre-filled questionnaire can go out before the first commercial conversation, if that speeds up your review.
Procurement and contracting
Contracting
Contracts of 6 or 12 months, from three executives. The contracting entity is Brazilian, and invoicing runs through Stripe in your own currency, so the jurisdiction stays our problem rather than your finance team's.
LGPD
We act as processor of the executives' personal data; your company is the controller, and we process the data only under its instruction. The governing law is Brazilian — LGPD, Law 13.709/2018 — because the contracting entity and the contract are Brazilian. The named data protection officer and the data-subject request channel are in the contract.
Subcontracting
Editorial production is done by our own team. Design and video suppliers, when contracted as an add-on, are named individually.
How the check works
Your legal team comes off the weekly path.
At an agency the text is written and then sent for legal review, which turns your legal team into a bottleneck every week. Here their rules are defined once, at setup, and every piece is verified against them before it reaches the executive. Whatever does not pass goes back for a rewrite with the reason attached. Legal comes in on the definition of the rules and on the exceptions, and drops out of the weekly path.
Take the finished pack into your internal meeting.
The compliance pack, the DPA and the pre-filled security questionnaire arrive within one business day, in PDF, ready to attach to a process.
Asking for the documentation books no conversation. Write to contato@katalista.com and the files go straight out.