POLICY · VERSION 1.0
Code of Ethics and Conduct
1. Purpose and scope
This Code sets out the principles and rules of conduct that guide NESS Processos e Tecnologia Ltda. (CNPJ 72.027.097/0001-37), in business since 1991, and its brands: ness., focused on IT operations and security; trustness., focused on governance, risk, compliance and privacy; and forense.io, an autonomous digital forensics and investigation unit.
The Code applies to partners, employees, interns and third parties acting on behalf of any of the three brands, such as suppliers, service providers, consultants, business partners and representatives. Anyone who hires third parties on behalf of NESS must make this Code known to them and require compliance with it.
The Code is part of the NESS integrity program and is based on Brazilian Law No. 12,846/2013 (Anti-Corruption Law), Decree No. 11,129/2022, which covers integrity programs, and the guidance of Brazil's Office of the Comptroller General (CGU) on the subject. It does not replace the law: where the law is stricter, the law prevails.
When in doubt about the right course of action, ask before acting, either your direct manager or the ethics committee.
2. Principles
NESS acts with integrity, honesty and transparency; respects people; complies with the law and with its contracts; protects the information entrusted to it; and takes responsibility for the consequences of its decisions.
The Board of Directors leads by example and visibly supports the application of this Code. No sales target, deadline or client request justifies conduct that goes against it.
3. Respect for people
NESS does not tolerate moral harassment, sexual harassment or any form of discrimination, whether based on origin, race, color, ethnicity, gender, gender identity, sexual orientation, age, religion, political belief, disability, social status, marital status or any other personal characteristic.
Moral harassment is repeatedly exposing someone to humiliating, embarrassing or intimidating situations, including through messages and remote meetings. Sexual harassment is any unwelcome conduct of a sexual nature, such as comments, insistent invitations, physical contact or sending content, whether or not there is a reporting relationship.
Everyone must treat colleagues, clients, suppliers and the public with courtesy and respect, and help keep the workplace safe and healthy. Anyone who witnesses or experiences such conduct should report it through the ethics channel.
4. Conflicts of interest
A conflict of interest exists when a personal, family or third-party interest may influence, or appear to influence, a decision made on behalf of NESS.
Any situation that may be a conflict must be disclosed to your direct manager and to the ethics committee as soon as it arises, such as an ownership stake in, or work for, a client, supplier or competitor; a family or romantic relationship with someone who makes a hiring or purchasing decision; or an outside activity that competes with NESS or uses company time, information or resources.
A person with a conflict does not take part in the decision. Disclosure in itself is not misconduct; failing to disclose is.
5. Anti-corruption
It is forbidden to promise, offer, give, request or accept, directly or indirectly, any improper advantage to or from a public official or any other person, in Brazil or abroad, to obtain or retain business, influence a decision or receive favorable treatment. This also applies when the advantage passes through third parties, such as consultants, intermediaries or relatives.
Facilitation payments, meaning amounts paid to speed up or secure a routine government action, are forbidden in any amount.
Gifts and hospitality may only be offered or accepted when they are of modest value, occasional, unrelated to any pending decision and recorded transparently. Cash or cash equivalents, such as gift cards, are never offered or accepted. When in doubt, consult the ethics committee beforehand.
Dealings with public officials, including in public tenders and government contracts, must be professional, documented and, whenever possible, attended by more than one person from NESS. It is forbidden to defraud, rig or undermine the competitive nature of public tenders, or to obstruct oversight by public bodies.
Accounting and financial records must reflect transactions completely and accurately. Donations and sponsorships require approval by the Board of Directors and must be recorded, and NESS makes no contributions to political parties or campaigns.
Third parties acting on behalf of NESS undergo an integrity assessment proportional to the risk before they are hired.
6. Fair competition
NESS competes on the quality of its work. It is forbidden to fix prices, divide markets or clients, coordinate bids with competitors, obtain competitor information by unlawful or unfair means, or make false statements about competitors or about our own services.
7. Confidentiality and personal data
Information belonging to NESS, clients, suppliers and individuals may only be used for the purpose for which access was granted, and shared only with those who need it for their work. The duty of confidentiality continues after a contract or employment ends.
Personal data is processed in accordance with the LGPD (Brazil's General Data Protection Law, Law No. 13,709/2018) and with the NESS privacy and information security policies. Data must be processed for a defined purpose, only to the extent necessary and with appropriate protection. Any suspected data incident must be reported immediately to the information security lead.
8. Use of company resources and artificial intelligence
NESS equipment, systems, accounts, licenses and information are provided for work and must be used with care and in accordance with internal policies. Occasional personal use must not harm work, security or the company's reputation.
Artificial intelligence tools support the work but do not make decisions. Every decision that affects clients, individuals or NESS itself is made and owned by a person, who reviews the output before using it. It is forbidden to enter client confidential information, personal data or internal information into any tool that NESS has not approved for that use.
9. Independence of forense.io
forense.io operates with technical independence. Its fees never depend on the outcome of an examination or investigation, or on the success of whoever hired it.
Any relationship between forense.io and the other brands of the NESS ecosystem that is relevant to a case is disclosed to the client before work begins.
forense.io declines engagements in which NESS itself, any of its brands or people connected to it have an interest in the outcome, and engagements in which its independence could reasonably be questioned.
10. Communication and social media
Only people authorized by the Board of Directors speak on behalf of NESS. Requests from the press and from authorities must be referred to them.
On social media, each person is responsible for what they post. It is forbidden to disclose confidential information, client data or details of projects or incidents, or to publish content that could be taken as an official NESS position without authorization.
11. Ethics channel
Anyone who knows of or suspects a violation of this Code, of NESS policies or of the law should report it through the ethics channel on the website. The channel is open to employees, third parties, clients and the public.
Reports may be made with your name or anonymously. For anonymous reports, the channel issues a protocol number and a password, which let you follow the case and answer questions without revealing your identity.
Reports are investigated by the ethics committee, confidentially and impartially. Anyone named in a report takes no part in handling it and has no access to it. The identity of the reporter and the details of the case are protected and shared only to the extent needed for the investigation or when required by law.
NESS forbids any form of retaliation against anyone who reports in good faith or cooperates with an investigation, even if the concern is not confirmed. Retaliation is itself a serious violation of this Code. Knowingly false reports made to harm someone are also a violation.
12. Disciplinary measures
A violation of this Code exposes the person responsible to measures proportional to the seriousness of the facts, such as counseling, a warning, suspension or termination, including termination for cause, as provided by law. For third parties, a violation may lead to suspension or termination of the contract. These measures do not exclude civil or criminal liability, or reporting to the authorities where appropriate.
13. Approval, validity and review
This Code was approved by the Board of Directors and is effective as of October 11, 2026, as version 1.0. It is reviewed at least every two years, or sooner if there is a significant change in the law or in the business or risks of NESS. The ethics committee proposes revisions and the Board of Directors approves them.