Security Directory

E

Ebazar.com.br LTDA.

mercadoshops.com.br

0

Mercado Shops, part of the Mercado Livre ecosystem, is an e-commerce platform serving sellers in Brazil. The website announces the discontinuation of Mercado Shops by the end of 2025 and encourages sellers to transition to 'Minha página', a personalized online store within Mercado Livre. The platform is well integrated with Mercado Livre's marketplace and payment services, targeting sellers who want to maintain and grow their online presence. Technically, the site uses modern web technologies including React, New Relic monitoring, and Google Analytics, hosted on Amazon AWS with a valid SSL certificate and strong security headers. However, the absence of TLS 1.2 or 1.3 protocols is a notable gap. The site implements cookie consent and privacy policies compliant with local regulations but lacks explicit public security policies or incident response information. Overall, the business is positioned as a leading e-commerce enabler in Latin America with a strong digital presence and good security posture, though improvements in TLS configuration and transparency on security policies are recommended.

A

Apiki

apiki.com

0

Apiki is a specialized WordPress service provider based in Brazil, recognized as the first Brazilian company dedicated exclusively to WordPress with over 15 years of experience. The company offers comprehensive WordPress solutions including development, support (WP Care), managed hosting (WP Host), growth services, and UX/UI design. Apiki holds a strong market position as a leading WordPress specialist in Brazil, serving a broad client base across multiple states with a team of over 90 professionals. Their digital presence is supported by a modern WordPress infrastructure using Elementor and Astra theme, hosted on AWS DNS infrastructure, and integrated with multiple marketing and analytics tools such as Google Tag Manager, Microsoft Clarity, and Facebook Pixel.

B

Bitrix Inc

bitrix24.com.br

0

Bitrix Inc operates Bitrix24, a comprehensive SaaS platform offering CRM, project management, collaboration, marketing, and HR automation tools. With a strong market presence serving over 15 million organizations globally and availability in 18 languages, Bitrix24 positions itself as an enterprise-grade solution for businesses of all sizes. The platform supports web, mobile, and desktop clients, leveraging a proprietary Bitrix framework and modern web technologies. Security posture is adequate with valid SSL certificates and no known vulnerabilities, but lacks modern TLS protocol support and advanced security headers. The website demonstrates good GDPR and cookie compliance with consent mechanisms and detailed policies. Extensive use of analytics and marketing tools indicates a mature digital marketing strategy. Overall, Bitrix24's website reflects a professional, trustworthy, and technically competent business with room for security enhancements.

M

Mercos

mercos.com

0

Mercos is a Brazilian software company specializing in B2B sales automation and e-commerce solutions tailored for industries, distributors, and commercial representatives. Positioned as one of the most utilized sales systems in the market, Mercos offers a comprehensive suite of services including sales force automation, B2B e-commerce portals, AI-powered order processing, payment systems, and video call sales features. The company targets medium-sized businesses seeking to streamline their sales operations and integrate seamlessly with existing ERP systems. Their market presence is reinforced by over 8,700 clients and 52,000 users, highlighting strong adoption and trust within their niche. Technically, Mercos leverages modern web technologies such as React and JavaScript, hosted on Amazon Web Services infrastructure with CloudFront CDN for content delivery. The site integrates multiple marketing and analytics tools including Google Tag Manager, HubSpot, RD Station, and Visual Website Optimizer, indicating a mature digital marketing strategy. Performance is optimized with preloading scripts and responsive design, ensuring good mobile experience and SEO. From a security perspective, Mercos maintains a valid SSL certificate issued by Amazon but currently lacks support for modern TLS protocols and advanced security headers. DNS security features like DNSSEC and CAA are not enabled, and no explicit security or incident response policies are publicly disclosed. While no critical vulnerabilities are detected, the absence of cookie consent mechanisms and limited privacy compliance features suggest areas for improvement. Overall, Mercos presents a robust business and technical foundation with excellent user experience and market positioning. However, enhancing security configurations, privacy compliance, and transparency around incident response would strengthen their risk posture and customer trust.

E

Ebazar.com.br LTDA.

mercadolivre.com.br

0

Mercado Livre Brasil is a leading e-commerce marketplace platform in Brazil, offering a wide range of products across numerous categories with a strong focus on user experience, accessibility, and comprehensive service offerings including payment processing, shipping, and subscription services. The platform is supported by a robust technical infrastructure leveraging modern web technologies and extensive third-party integrations for analytics and advertising. Security measures are well implemented with strong SSL configurations and security headers, although some improvements in protocol support and explicit security policies could enhance the posture further. Overall, the website demonstrates high professionalism, trustworthiness, and digital maturity, positioning it as a dominant player in the Brazilian e-commerce market.

O

Olist Vnda

vnda.com.br

0

Olist Vnda is a leading Brazilian omnichannel e-commerce platform designed to empower online retailers with integrated technology and marketing tools to accelerate business growth. The platform offers advanced features such as marketing automation, order management, and direct sales force digitalization, positioning itself strongly in the competitive e-commerce market. Technically, the website is built on modern frameworks like Next.js and React, leveraging Cloudflare for hosting and security. It integrates multiple analytics and marketing tools including Google Analytics, Mixpanel, LinkedIn Insight Tag, and Bing UET, indicating a mature digital marketing strategy. However, the security posture reveals critical gaps, notably the absence of a valid SSL/TLS certificate and disabled TLS protocols, which significantly undermine secure communications and user trust. While security headers are well configured, the lack of HTTPS is a major vulnerability. The website demonstrates excellent design, user experience, and content quality, with strong branding and trust signals such as customer case studies and comprehensive privacy policies. Strategic recommendations include immediate SSL/TLS deployment, enabling modern TLS protocols, and implementing cookie consent mechanisms to enhance compliance and security.

V

Vindi

vindi.com.br

0

Vindi is a leading Brazilian payment hub platform specializing in managing and processing online payments, with a strong focus on recurring billing, e-commerce, and financial services. The company offers a comprehensive suite of services including payment gateways, credit lines, antifraud solutions, and APIs for seamless integration with marketplaces and other platforms. Their market position is reinforced by significant transaction volumes and a portfolio of reputable clients. Technically, the website is hosted on Amazon S3 with CloudFront CDN, uses modern frontend frameworks like Bootstrap, and integrates Google Tag Manager for analytics and marketing. The site demonstrates good SEO and mobile optimization practices. Security-wise, Vindi maintains a valid SSL certificate and avoids known SSL vulnerabilities, but lacks enabled TLS protocols and HSTS, and DNSSEC is not configured, indicating areas for improvement. Overall, the company shows a mature digital presence with strong branding and trust signals, though security hardening and compliance transparency could be enhanced.

O

Olist

tiny.com.br

0

Olist Tiny is a comprehensive ERP, integration hub, and digital account platform targeting Brazilian e-commerce businesses. It offers a stable and integrated system to streamline sales, inventory, and financial operations, positioning itself as a key player in the Brazilian e-commerce technology market under the Olist group umbrella. The website demonstrates a mature technical infrastructure leveraging Next.js, React, Cloudflare, and AWS services, ensuring fast performance and good mobile optimization. Security posture is solid with a valid SSL certificate and modern security practices, though improvements such as enabling HSTS and DNSSEC are recommended. Privacy policies and terms of service are present and comprehensive, but cookie consent mechanisms are lacking. Overall, the platform shows strong business credibility, technical sophistication, and a clear focus on serving small to medium-sized e-commerce enterprises in Brazil.

L

Loja Integrada

lojaintegrada.com.br

0

Loja Integrada is a large Brazilian e-commerce platform provider enabling over 2.7 million online stores to create and manage their businesses with ease. The platform offers a comprehensive suite of services including dropshipping, marketing automation, payment and logistics integrations, and a rich app marketplace. The website is built on WordPress with Elementor and integrates multiple marketing and analytics tools such as HubSpot, VWO, Google Analytics, TikTok Pixel, and Microsoft Clarity, reflecting a mature digital infrastructure. Security measures include a valid Amazon-issued SSL certificate and Google reCAPTCHA integration, although advanced security headers and DNSSEC are not enabled. The site demonstrates good privacy and cookie policy compliance with active consent mechanisms. Overall, Loja Integrada presents a professional, trustworthy, and well-branded online presence with extensive user tracking and marketing capabilities.

E

Ebazar.com.br LTDA.

kangu.com.br

0

Kangu operates as a shipping intermediation service within the Mercado Livre ecosystem, providing logistics support and customer service related to package delivery, reimbursements, and digital wallet credits. The business is positioned as a partner service to Mercado Livre, focusing on transportation and e-commerce sectors in Brazil. The website demonstrates a moderate level of digital maturity with the use of modern JavaScript frameworks, monitoring tools like New Relic and OpenTelemetry, and integration with Mercado Livre's analytics and infrastructure. However, the security posture is weak due to the absence of a valid SSL certificate and lack of advanced security headers, which poses risks to user data confidentiality and trust. The site includes cookie consent mechanisms and complies with basic email authentication standards but lacks explicit security and incident response policies. Overall, the business shows good operational integration but requires significant improvements in security to protect its users and maintain trust.

B

Bling - Sistema de gestão online

bling.com.br

0

Bling is a prominent Brazilian SaaS ERP platform offering comprehensive business management solutions including sales, inventory, logistics, finance, and automation. It serves a large user base of over 300,000 daily users, targeting entrepreneurs, SMEs, e-commerce, physical stores, service providers, and small industries. The platform integrates with over 250 marketplaces and sales channels, providing automated invoicing and financial management with a digital account. Technically, the website is built on WordPress with modern optimization plugins like WP Rocket and uses various JavaScript libraries for UI and analytics. Security posture is solid with a valid SSL certificate and HSTS enabled, but lacks modern TLS protocol support and DNS security enhancements. Privacy and terms policies are present but cookie consent mechanisms are absent. Overall, the site demonstrates good digital maturity and strong market positioning in Brazil's ERP sector.

Z

ZACHARY SOLUCOES EM MARKETING E INTERNET LTDA

zachary.com.br

0

Zachary Soluções em Marketing e Internet Ltda is a Brazilian company specializing in digital business optimization, focusing on ERP, e-commerce, marketplaces, and integrated management solutions for small and medium-sized enterprises (PMEs). Founded in 2016 and based in São Paulo, Zachary offers consulting, implementation, and training services to help clients achieve operational efficiency and sustainable growth. The company maintains a strong market position with a diverse client base and partnerships with major e-commerce platforms and payment gateways. Technically, the website is built on WordPress with Elementor and Elementor Pro, hosted behind Cloudflare CDN and served via a LiteSpeed server. It employs modern SEO tools like Rank Math and integrates Google Analytics and Google Tag Manager for tracking, with consent mode scripts to manage privacy compliance. The SSL certificate is valid but lacks support for modern TLS protocols, and security headers are partially implemented. From a security perspective, the site shows good practices such as valid SSL, Cloudflare protection, and email obfuscation. However, it lacks advanced security features like HSTS, DNSSEC, and published security or incident response policies. No explicit privacy or cookie policies were found, though a consent mechanism is partially implemented via Google consent mode. Overall, Zachary demonstrates a solid digital presence with good technical infrastructure and a focus on client success. To enhance trust and compliance, it should improve security configurations and publish comprehensive privacy, cookie, and security policies.

T

Tray - Plataforma de E-commerce

tray.com.br

0

Tray is a leading Brazilian e-commerce platform offering a comprehensive suite of tools for online and physical store owners to manage and scale their businesses. The platform integrates with over 30 marketplaces, payment processors, and logistics providers, providing a unified management experience. The website demonstrates a mature digital presence with extensive content, customer testimonials, and a strong partner ecosystem. Technically, the site is built on WordPress with Elementor and uses modern JavaScript libraries and performance optimizations. Security-wise, the site has a valid SSL certificate but lacks modern TLS protocol support and HSTS, indicating room for improvement. Overall, Tray presents a professional and trustworthy platform with a strong market position in the Brazilian e-commerce sector.

W

Wev Empreendimentos Comerciais EIRELI

redbullshop.com.br

0

Redbullshop.com.br is the official Brazilian e-commerce store for Red Bull branded merchandise, operated by Wev Empreendimentos Comerciais EIRELI. The website offers a variety of products including apparel and accessories related to Red Bull's sports teams and lifestyle brands. Positioned as an official retailer, it targets consumers interested in Red Bull's adventurous and energetic brand image. The site leverages the Tray Commerce platform and integrates multiple marketing and analytics tools such as Google Analytics and Facebook Conversion pixels. Technically, the site is well-structured with a valid SSL certificate and security headers, but lacks modern TLS protocol support and DNSSEC, indicating room for security improvements. Privacy and cookie policies are present with consent mechanisms, but explicit security and incident response policies are not found. Overall, the website demonstrates a good balance of branding, user experience, and basic security practices.

This website has 1 critical security issue(s) requiring immediate attention. Overall security score: 50/100 (unknown risk level). A comprehensive security review is recommended.

E

Engeco Engenharia e Construção LTDA

engeco.com.br

0

The website's overall security posture is critically weak, with multiple high and critical severity issues spanning encryption, compliance, and network exposure. The absence of HTTPS encryption exposes all data transmissions to interception and tampering, representing a fundamental risk. Key security headers that protect against common web attacks are missing, increasing vulnerability to clickjacking, MIME sniffing, and cross-site scripting. Compliance deficiencies, particularly with GDPR and NIS2 regulations, pose significant legal and reputational risks due to missing privacy policies, cookie consent, and documented security policies. Network services such as FTP and MySQL are exposed without adequate controls, presenting easy attack vectors for unauthorized access. While email security and DNS health show relatively better scores, critical gaps in vulnerability disclosure, incident response, and business continuity planning further weaken organizational resilience. Immediate attention is required to establish a secure baseline, ensure regulatory compliance, and protect customer data to maintain trust and avoid costly breaches.

V

Vale

vale.com

0

The website's overall security posture is critically weak, primarily due to the absence of HTTPS encryption, which exposes all data transmissions to interception and undermines user trust. Significant gaps exist in compliance with GDPR and NIS2 regulations, including missing privacy and cookie policies, lack of consent mechanisms, and absence of essential security documentation such as incident response and information security frameworks. Security headers are inadequately configured, increasing vulnerability to common web attacks like cross-site scripting. While network security and email security show strong scores, foundational web security controls are missing, presenting substantial legal, reputational, and operational risks. Immediate remediation is essential to protect user data, comply with regulations, and sustain business continuity. Without urgent action, the business risks regulatory penalties, data breaches, and loss of customer confidence. Addressing these issues will significantly enhance the organization's security resilience and trustworthiness.

O

One Partners

onepartners.com.br

0

The website's overall security posture is critically weak, exposing the business to significant cyber risks and regulatory non-compliance. The absence of HTTPS encryption is a critical vulnerability impacting data confidentiality and user trust, with cascading effects on GDPR and NIS2 compliance. Multiple missing security headers increase susceptibility to common web attacks such as clickjacking, MIME sniffing, and cross-site scripting. The exposure of critical services like MySQL and FTP without adequate protections further elevates the risk of data breaches and unauthorized access. Additionally, the lack of essential documentation and policies—including privacy, cookie, security, and incident response—exposes the organization to legal and operational risks. Although email security and DNS health scores are relatively strong, they do not compensate for the critical infrastructure and governance gaps. Immediate remediation is necessary to protect sensitive data, maintain customer confidence, and ensure regulatory compliance. Failure to act could result in financial losses, reputational damage, and potential regulatory penalties.

S

Swedish Match

fiatlux.com.br

0

The website's security posture is currently weak, with multiple critical and high-severity issues that expose the business to significant operational, reputational, and compliance risks. Key deficiencies include missing essential security headers, absence of GDPR compliance elements such as privacy and cookie policies, and lack of formal information security frameworks and incident response planning aligned with NIS2 requirements. Critically, an exposed MySQL service represents an immediate threat vector for data breaches. Additionally, outdated SSL/TLS configurations and missing security policies further increase vulnerability to attacks. While email security and DNS health show relatively strong scores, they do not compensate for core infrastructure and governance gaps. Immediate attention is needed to remediate critical exposures and establish foundational legal and security controls to mitigate regulatory penalties and data compromise. Overall, the current state could impact customer trust, lead to legal liabilities, and threaten business continuity if unaddressed promptly.

This website has 1 critical security issue(s) requiring immediate attention. Overall security score: 50/100 (unknown risk level). A comprehensive security review is recommended.

I

INDEPEND

independ.com.br

0

The website independ.com.br exhibits a critically weak security posture with multiple high and critical severity issues, notably lacking HTTPS encryption and essential security headers. This exposes the business to significant risks including data breaches, regulatory non-compliance (GDPR, NIS2), and potential service disruptions. Immediate remediation is necessary to protect customer data, maintain trust, and comply with legal requirements.

The bireme.org website exhibits a generally strong technical security posture in network and email security but suffers from significant compliance and governance gaps, particularly concerning GDPR and NIS2 regulations. Critical business risks stem from the absence of privacy policies, security frameworks, and incident response procedures, which could expose the organization to legal penalties and reputational damage. Addressing these compliance and policy deficiencies should be prioritized to ensure regulatory adherence and build stakeholder trust.

The Mastercard Brazil website demonstrates strong network and SSL/TLS security but exhibits significant shortcomings in privacy compliance (GDPR), security governance (NIS2), and HTTP security headers. These gaps expose the business to regulatory risks, potential data privacy violations, and increased vulnerability to targeted attacks. Addressing these weaknesses is critical to maintaining customer trust, regulatory compliance, and overall brand reputation.