Security and regulation at the core of every transaction
A payment institution authorized by the Central Bank of Brazil (IP 619), with access controls, per-environment credentials, signed webhooks and a public security policy from the first integration.
Security center for your team's risk review.
What a vendor due-diligence review checks, with the document or the control behind each item.
1.0 A regulated institution
A regulated institution
supervised by the Central Bank of Brazil
Trio Instituição de Pagamento Ltda is authorized by the Central Bank of Brazil (BCB) to issue electronic money, initiate payments and act as an acquirer, with its own infrastructure and a direct connection to the BCB.
- Legal name
- Trio Instituição de Pagamento Ltda
- CNPJ
- 49.931.906/0001-19
- Authorization
- Central Bank of Brazil
IP 619 - ISPB
- 49931906
- Activities
- Electronic money issuance, payment initiation and acquiring
2.0 Information security
Information security
as a public policy
Trio's Information Security Policy follows Resolução BCB nº 85/2021 (the Central Bank's cybersecurity rule) and sets the principles, guidelines and responsibilities that protect everything the operation handles. It is reviewed at least once a year and backed by specific policies.
Read the full policy- 01
Confidentiality
Access to information is limited to authorized people.
- 02
Integrity
Information stays accurate, complete and free from improper changes.
- 03
Availability
Information and systems are reachable whenever the operation needs them.
- 04
Authenticity
Communications, transactions and systems with a guaranteed origin, including digital certificate management.
Controls set out in the policy
Encryption at rest and in transit
Industry-recognized algorithms and protocols, with restricted-access keys and a defined lifecycle.
Least privilege
Access is granted, reviewed and revoked with segregation of duties and periodic reviews.
Secure development
OWASP Top 10, secure by design and secure by default, with security testing of critical systems at least once a year.
Intrusion detection
Continuous monitoring to identify, block and respond to unauthorized access and anomalous activity.
Incident management
Incidents are logged, analyzed and handled, and reported to regulators and data subjects when applicable.
Business continuity
Contingency plans and continuity tests to restore critical processes and services quickly.
Logs and audit
Relevant events are logged, protected and analyzed under the logging policy.
Encrypted backups
Backups of critical data, encrypted and kept for defined retention periods.
Vetted suppliers
Technology suppliers are monitored, with security, confidentiality and data protection clauses.
3.0 Access and approvals
Access and approvals
set before the first payment
Add users to the corporate account and control who can view data, operate the account and approve transactions. Rules by amount, department or owner hold each payment until it is approved, and every action leaves a traceable record.
Explore the Corporate Account3.1 Compliance rules
Compliance rules
on every account
Automatic blocks and refunds act before money comes in or goes out. When a deposit breaks a rule, Trio refuses it back to the payer's account and sends a failed event for your system to handle.
How to keep a closed loop4.0 Secure integration
Secure integration
by default
Every webhook arrives signed, every credential works in a single environment and API use is limited to the IP addresses you register.
Webhook authentication- 01Signature
Signed webhooks
Every payload is signed with HMAC-SHA-256 in the x-webhook-signature header. The secret registered on the webhook arrives in x-webhook-secret.
x-webhook-signature - 02Environments
Separate credentials
Sandbox and production are fully separate environments, each with its own credentials, webhooks and secrets.
sandbox ≠ production - 03Network
Registered IPs
When you create an API credential, you register the IP address of the server that will use it.
allowlist per credential - 04Front end
Secrets stay out of the browser
Checkout sessions are created on your backend, so the client_secret never reaches your users.
POST /checkout/sessions - 05Organizations
Access checked on every call
When you operate another organization with Trio-Target-Org-Id, the permission is validated on every request. Read-only access accepts only GET and HEAD.
403 without access - 06Rotation
Key exposed?
If a webhook key is exposed, support rotates it and coordinates the switch with your team. Use HTTPS on every endpoint.
suporte@trio.com.br
5.0 Availability
Availability for teams operating at scale.
High-availability settlement on Trio's own infrastructure with a direct connection to the Central Bank of Brazil, Pix 24/7, contingency plans and 24/7 operations support for incidents, transaction checks and reconciliation.
- uptime1
- 99.99%
- Pix and human support2
- 24/7
- processed in the last 12 months3
- R$100B
- of support per 100,000 transactions4
- 1 ticket
- 1 Platform availability.
- 2 Pix runs 24 hours a day, 7 days a week, with support for incidents, transaction checks and reconciliation.
- 3 Financial volume processed by Trio in the last 12 months.
- 4 Support tickets opened relative to transactions processed.
6.0 Public policies
Public policies
open whenever you need them
The documents that guide Trio's security, privacy and integrity are available in full.
All policies and terms- Information Security PolicyEstablishes Trio's principles, guidelines and responsibilities for ensuring the confidentiality, integrity, availability and authenticity of information, in compliance with Resolução BCB nº 85/2021 (Central Bank of Brazil Resolution No. 85/2021).
- Privacy PolicyExplains how Trio collects, uses, stores, shares and protects the personal data of customers, partners, suppliers, employees and end users, in compliance with the LGPD (Brazil's General Data Protection Law), banking secrecy rules and Central Bank of Brazil regulations.
- AML/CFT (PLD/FT)Policy for the Prevention and Combating of Money Laundering and Terrorist Financing: establishes the principles, guidelines and responsibilities adopted by Trio to prevent, detect and report such situations, based on Lei nº 9.613/1998 (Law No. 9,613/1998, Brazil's anti-money laundering law) and the applicable regulations.
- Code of Ethics and ConductEstablishes the principles and guidelines that govern the conduct of Trio's employees, partners, executives, customers, investors and business partners, ensuring alignment with ethical practices and the strengthening of the corporate culture.
7.0 Channels
Channels
to reach Trio
- Ombudsman
Ombudsman channel
For complaints that already have a ticket number. Also on WhatsApp at 0800 000 3102.
Open - Integrity
Whistleblowing Channel
Only for reporting breaches of the Code of Conduct.
Open - Privacy
Data Protection Officer
To exercise your data subject rights under the LGPD (Brazil's data protection law).
dpo@trio.com.br - Support
24/7 support
Operational incidents, transaction checks and emergencies.
Open
Frequently asked
questions
Is Trio regulated by the Central Bank of Brazil?
Yes. Trio Instituição de Pagamento Ltda (619), registered under CNPJ (company tax ID) 49.931.906/0001-19, is authorized by the Central Bank of Brazil to issue electronic money, initiate payments and act as an acquirer.
How do I confirm that a webhook was sent by Trio?
Every payload is signed with HMAC-SHA-256, and the signature arrives in the x-webhook-signature header. Compute the HMAC of the raw request body, before any JSON parsing, with your webhook's key (notification_key), available on the webhook settings page, and compare the two values in constant time. See the authentication docs.
Do sandbox credentials work in production?
No. Sandbox and production are separate environments, each with its own credentials, webhooks and secrets. Production credentials are created after the contract is signed and compliance is cleared.
Can I decide who approves each payment inside my company?
Yes. Approval rules let you set conditions by amount or owner, so no payment or batch goes out without passing through the approval flow you define.
How do I exercise my data subject rights?
Contact Trio's Data Protection Officer (DPO) at dpo@trio.com.br. The details are in the Privacy Policy.
Where do I report misconduct?
Through the Whistleblowing Channel, which is only for reporting breaches of the internal Code of Conduct. For complaints about a service you received, use the Ombudsman.