Well, it looks like this is turning into a column just for me. This week alone we talked about how we are preparing our data for artificial intelligence and how we will start using it in the coming months as part of our cognitive computing strategy. We also talked about how we guarantee data protection for the people here at Casa Hacker, our members, and our community—from a slightly more technical standpoint on how we look after the security of this information. And we further talked about how we are advancing in accessibility through the platforms we develop, also commenting on some initiatives we have in the field.
This year, we participated in a Neoenergia capacity-building initiative focused on integrity and compliance policies in third-sector organizations. As an organization in our sector, we decided to take part. Curiously, it has been about a year and a half since we started working here to ensure compliance and integrity, and we have implemented a series of initiatives that were discussed precisely in that meeting—which makes it so important to be alongside other organizations in spaces that set the agenda for this topic. It is the moment when we bring learnings and evaluate how well we align with what our sector expects.
Looking at this, today I decided to share a bit of how we have progressed over this past year and a half: the policies we created, the training sessions, the whistleblower channel, day-to-day guidance, and incident identification.
What an integrity program is, without legalese
An integrity program is the set of rules, controls, training, and channels that help an organization prevent what can go wrong, detect quickly what slips through, and correct what has happened.
Put like that, it sounds abstract. In practice, it answers very concrete, everyday questions:
- When a payment goes out, is there a document, approval from someone authorized to approve, and a record of who decided?
- When we hire a supplier, did someone check where their name appears—and when was that check performed?
- When someone wants to report something serious, is there a safe path that doesn’t depend on the goodwill of the person being reported?
There is a legal reason to care about this: the Anticorruption Law (Law No. 12.846/2013) reaches associations and foundations, and having an integrity program counts as a mitigating factor if something goes wrong. But that is not why we do it. It is because an organization like ours exists on trust. Donation, sponsorship, agreement, volunteering, and reputation take years to build and seconds to lose. Integrity is what protects the mission—not a cost that gets in the way of operations.
And our program relies on three decisions that we repeat internally until they become a habit:
Proportional to our size. We don’t copy a multinational’s compliance program. We build what fits here and what we can maintain.
Control lives in the process. No important rule depends on someone remembering it on the spot. It is built into the standard procedure: if the supplier check is missing, the purchase simply doesn’t move to the next stage.
Everything leaves a trace. Every relevant decision has an author, date, justification, and document. That is what transforms “we do it the right way” into something we can show to a donor, a funder, or a control body.
Who leads this work
Today, the program is led by Everton Justo, Compliance Analyst at Casa Hacker. Everton holds a degree in Business Administration from Faculdade Mário Schenberg, with a postgraduate degree in Financial Management and Controllership, and has been with us since September 2025. His background in controllership helps immensely. On a day-to-day basis, he takes care of maintaining policies, program initiatives, conducting training, reviewing policies, handling reports that come through the channel, monitoring mandatory training, and working with Casa Hacker’s legal counsel to answer questions from various areas. He has a distinct role—Compliance Analyst—with specific permissions and an audit trail. Having a designated person is the first step of any integrity program, and it holds true even for small organizations: the role can be accumulated, but it cannot remain nameless. Integrity that is “everyone’s responsibility” usually becomes no one’s responsibility.
What the Board of Directors and the Council assume
Leadership sets the tone of the house. Without real support from decision-makers, an integrity program becomes paper in a drawer. That is why our commitment is written in the most concrete place possible: who owns what.
The Board of Directors owns and responds to reports and investigations from the areas under its direction—Projects and Administration—approves policies, and receives periodic reports from the whistleblower channel.
The Board of Trustees owns reports in which the Board of Directors itself is involved.
This second line is what gives credibility to the first. A channel where every case ends up at the Board works well for most reports and fails precisely in the most serious ones—when the person being reported is the director. The alternative route must exist before it is needed; afterward, it is too late.
The commitment also shows up where it is inconvenient. The Board’s approval is mandatory for purchases meeting certain criteria. There are no shortcuts based on title.
And there is the less glamorous part of governance, which we have learned to treat as control rather than bureaucracy: the mandate, election minutes, and terms of office for each body are registered and kept up to date—Board of Trustees, Board of Directors, and Fiscal Council.
The policies, fully public in their entirety
Today we have 23 active policies, all of mandatory reading, published in our system with version control, effective dates, and individual logs of who read them. They cover integrity (Code of Ethical Conduct, Anticorruption Manual, Whistleblower Channel, Child and Adolescent Protection), legal and data topics, purchasing, payments and travel, and the institutional field.
Instead of listing everything here, the best approach is to go straight to the source: all our policies are published in full at casahacker.org/movimento, alongside corporate records, certifications, and annual reports. This is not a summary or a promotional version—it is the full text, exactly as it applies internally. Complete governance can also be found at docs.casahacker.org.
What matters more than the quantity is this: each policy has a corresponding process. The purchasing policy became a stage-by-stage ruler with authority levels. The data protection policy became a record of processing activities and data catalog. The whistleblower channel policy became a public form, protocol, and unalterable trail. Policy without control is intention; control without policy is improvisation.
What is underway
Annual policy maintenance
Active policies have been in place for years, but were edited in June 2026 and undergo annual maintenance: content review, updates for operational changes, and a new round of logged readings. New policies enter through the same door—draft, approval, versioned publication.
Whistleblower channel
Our channel is called Abre o Jogo and operates at cockpit.casahacker.org/denuncias, open to anyone inside or outside Casa Hacker, without registration or login.
Three things about it are non-negotiable:
True anonymity. Those who choose anonymity provide no name or contact info, and the system does not record the internet address of the visitor. The counterpart is honest and written right on the screen: upon submission, the person receives a protocol number, and with it—and only with it—they return to track the case, respond, and attach documents. There is no password to recover. Real anonymity means even we cannot re-identify who spoke.
Unalterable trail. Every step of the investigation is recorded in a chained sequence that does not accept subsequent alterations. When the retention period expires, sensitive content is deleted by human action, preserving only the aggregate—category, dates, outcome. And the deletion itself enters the trail.
Non-retaliation. Retaliating against anyone who reports in good faith is, per our policy, a grave violation in its own right, investigated as such.
Records are kept for at least five years, and the Compliance Analyst presents the Board with a report showing the number of reports, nature, average processing time, and measures adopted.
Training
We have eight published tracks, totaling 162 chapters and 171 assessment questions. The two central ones for the program are the Code of Ethical Conduct (17 chapters, 45 questions, with a signed commitment term at the end) and Data Protection and Information Security (49 chapters, 50 questions), published at the end of August with 23 people enrolled and a 12-month validity period. The other tracks support the same culture through different paths: psychological safety, assertive communication and feedback culture, media training, time management, project management, and an introduction to AI assistants.
Two methodological decisions here. First: training produces evidence—enrollment, completed chapters, graded tests, signed terms, and expiration dates. Without this, “everyone was trained” is an unsubstantiated phrase. Second: there is no individual ranking. Monitoring is done by area and by percentage, because the purpose is learning.
Guidance and internal support
A program that only shows up to punish gets used by no one. Ours also works as a service: the area answers everyday questions. Can I accept this gift? Do I need to declare this family relation? Does this reimbursement have enough documentation? How should I act in the face of a request from a public authority? There are already 45 inquiries logged in our internal consulting module, in addition to the question channel within the tracks and the Help Center. The informal rule is well known: it is always cheaper to ask beforehand.
Identification of incidents and risks
Here we try to maintain a living map rather than an annual snapshot—in data processing and project execution, for example:
- 29 personal data processing operations registered, with data catalog, legal basis, and identified operators
- 10 privacy risks assessed and 2 impact reports prepared for the most sensitive operations
- 291 governance documents archived and institutional obligations monitored by expiration date
- Daily project verification: 17 compliance rules run every day on the execution of our programs—activity without an owner, delivery without a date, delayed report, incomplete documentation—complemented by AI-assisted analysis that suggests planning improvements. A finding can only be dismissed by the Board, with a record. The analyst cannot delete pending items.
Relationship with politically exposed persons
Relationships with politically exposed persons are not prohibited. They are declared, documented, and monitored—and this distinction is important, because treating the topic as a taboo only sweeps the information under the rug.
In the questionnaire that every supplier answers, there is an entire block on this: whether any partner, board member, director, or representative qualifies as a politically exposed person under COAF rules; whether there is a relative up to the third degree who has been part of a government entity in the last five years; whether there is a family relationship with someone who works for, directs, or advises Casa Hacker; whether there is any pending litigation against us; whether there is a potential conflict of interest. A second block covers political relationships—candidacy, appointment, party position.
Every “yes” requires stating who the person is, their position, and the agency. In parallel with the declaration, the system cross-checks the information against the official database of politically exposed persons. Declaration without verification is just a form; verification without declaration loses context. We need both.
Supplier compliance: how it really works
This is the most mature part of the program, and it is worth telling in detail because it is where the technology we develop makes the biggest difference.
Every legal entity supplying goods and services to Casa Hacker goes through two different and complementary checks.
The first is due diligence. It runs in our system and queries, all at once:
- the Federal Revenue Service, for the CNPJ registration status and roster of partners and administrators—this is where the names feeding the rest of the search come from;
- nine national sources, by exact CNPJ: CEIS (disreputable and suspended companies), CNEP (penalized under the Anticorruption Law), CEPIM (impeded non-profit entities), leniency agreements, the registry of employers who subjected workers to conditions analogous to slavery—the “dirty list”—disreputable entities from TCU, penalized entities from TCE-SP, COBES-SP, and the database of politically exposed persons;
- six international sources, by name: OFAC SDN and OFAC Consolidated, from the US Treasury; the UN Security Council consolidated list; the European Union financial sanctions list; the UK Sanctions List from the United Kingdom; and the IDB sanctioned firms and individuals list.
The international lists are indexed in our own database: there are over 103,000 records, last updated on August 24. And the search reaches partners and administrators, not just the corporate name—because risk rarely lies in the CNPJ, it lies in the people behind it.
The result is a verdict with a 30-day validity, recorded with date, consultation author, raw response from each source, and integrity verification:
- clear — clears the next stage;
- alert — blocks the contracting process and requires human analysis;
- pending — some source did not respond, and the case does not move forward by omission, but by decision.
So far, 427 checks have been completed: 389 clear, 33 with alerts, and 5 pending. The 33 are proof that control is not merely decorative.
The second check is KYS—Know Your Supplier. It is an integrity questionnaire that the company signs: 17 questions in five blocks, covering politically exposed persons and conflicts of interest; political relationships; history of corruption, money laundering, and malfeasance; human rights (slave labor and human trafficking, racial injury, gender crimes, child labor exploitation); and sanctions, contractual history, and fiscal and social security regularity.
The supplier responds via a dedicated link, without needing to create an account in our system, and signs electronically with legal validity. In the same act, they authorize periodic queries against the databases used in the due diligence. For civil society organizations and individuals receiving our investments, the equivalent instrument is KYG—Know Your Grantee.
And where does this bite? A purchase request goes through ten stages at Casa Hacker, and stage 4 is the gate: without an active supplier, without a clear due diligence, and without a valid KYS or KYG for amounts above R$ 2,000, the purchase does not pass. It’s not just a screen warning—it is a hard block. And since rigid control with no emergency exit teaches people how to bypass rules, there is an authorizable exception: a manager with specific permissions, who cannot be the requester, clears the stage by recording the justification in the purchase audit trail. It is rare, nominal, and logged.
Our next steps
The next step has a name: Cognitive Computing, our strategy to bring all administrative operations into the proprietary system we develop here—with cloud computing, automation, and artificial intelligence acting from the very beginning of each process, rather than as a report at the end.
On the integrity front, what comes with this:
Continuous supplier auditing with global APIs. Today, verification is event-driven—new contracts, 30-day expiration. The goal is automated periodic monitoring of the entire active base, with alerts when a already contracted supplier appears on any list.
OCR and automatic document reading. Invoices, contracts, receipts, and certificates will be read by machines, with text indexed and checked against what was declared. Document verification stops being a line-by-line human eye check and becomes a flagged exception.
AI in analysis, with human decision. Assisted capture of budget and proposal data, pre-analysis of risk upon purchase submission, contract drafting, and planning improvement suggestions. AI suggests; humans confirm. That boundary does not move.
The same standard across all areas: administrative operations, purchasing, finance, contracts, data protection, PMO, volunteering, accounting, inventory, donations, and internal services.
It is worth noting where this comes from. Cockpit is Casa Hacker’s proprietary technology, built by us for management and integrity, and I’ve shared here before what needed to be done before asking AI its first question.
Our learnings so far
It was at the Neoenergia workshop—held in June in partnership with Instituto Neoenergia, Instituto Pro Bono Brasil, and the law firm Machado Meyer, involving nine third-sector organizations—that we had confirmation our policies cover the seven pillars presented as benchmarks: leadership commitment, code of conduct, risk mapping, policies and controls, training and communication, whistleblower channel, and monitoring with continuous improvement.
Confirming alignment is good. More useful is recording what we learned while building it:
- Designating a person is better than creating a committee. Roles can be combined, but there must be a name, permissions, and dedicated time.
- Policy without process control is just paper. The right question is not “do we have a purchasing policy?”, but rather “what happens when someone tries to buy without a quote?”.
- Leadership participates. There are value thresholds where Board approval is mandatory.
- Real anonymity has practical consequences—and that must be written on the screen. If we don’t record IP addresses or contacts, there is no way to recover lost tracking. Promising both at the same time is deceiving whoever reports.
- The most serious case is precisely what normal workflows don’t solve. Reports involving the Board need an alternative route designed beforehand.
- Verifying is better than declaring, and both together are even better. The supplier declares; the system verifies. One does not replace the other.
- Every verdict needs an expiration date. “Due diligence done” without a date is expired due diligence waiting to be discovered.
- Risk rarely lies in the CNPJ. It lies in the people behind it. Checks that don’t reach partners and administrators miss what matters.
- Exceptions must exist, be nominal, and remain recorded. Control without an emergency exit teaches people how to bypass it. With a traceable exception, deviation becomes management data.
- Training is evidence, not an event. Signed commitment terms, valid expiration dates.
- Not everything at once. Prioritize by impact and probability. A proportional program that works is worth more than a complete program nobody maintains.
- Recording failures is part of control. Incidents, recurring questions, and non-compliance feed the next policy review. A program without error history is a program not paying attention.
Why this has everything to do with our mission
A year and a half later, what I would say to anyone starting out is that integrity is not a department—it is the way work happens. It’s in the purchase waiting for verification to clear, the training ending with a test, the channel guaranteeing true anonymity, the children’s data we guard with extra care.
In our manifesto, we made a commitment to treat technology as a right and as a language of power, rather than a privilege for the few. Doing it the right way, always, is that commitment applied to our own house: those who entrust resources to the peripheries deserve to know exactly where they went, who decided, and based on what. When Casa Hacker was born, there was a simultaneous certainty that the peripheries are not places of waiting—they are places of beginnings. And places of beginnings must be trustworthy places.
Need to report something? The Abre o Jogo channel is at cockpit.casahacker.org/denuncias, open to anyone, with guaranteed anonymity for those who want it.