LGPD demands control, transparency, and security. Public AIs offer black boxes in foreign jurisdictions. This gap is the biggest legal and corporate risk of the decade.
LGPD is founded on principles inherently broken by uncontrolled use of third-party LLMs. It's not opinion — it's in the law.
LGPD mandates that data can only be processed for specific purposes. When an employee inserts customer data into a public LLM to "summarize a meeting", they're authorizing third parties to process it for their purpose (improving the model).
Most major AI tech servers are in the US. Sending personal data to these APIs without robust contractual guarantees or explicit consent constitutes irregular transfer — liable to ANPD sanctions.
If an AI agent makes an automated decision about a customer — denying a discount, flagging as "churn risk" — LGPD guarantees the right to review. In black-box LLMs, it's impossible to trace reasoning.
Shadow AI — employees using unauthorized AI at work — is the ultimate security breach. Your company loses possession and governance over where data sits and who has access.
Sovereignty goes beyond LGPD. It's ensuring your data is subject exclusively to Brazilian law — not the law of the country where the server's hosted.
The Clarifying Lawful Overseas Use of Data Act allows US intelligence agencies to demand access to data stored on US servers — even if your company is Brazilian and the data belongs to Brazilian citizens.
MyDatAgent's inference infrastructure (vLLM, GPUs, databases) runs in Brazilian datacenters. Data doesn't cross borders. Jurisdiction is exclusively Brazilian — shielding your company from the CLOUD Act and meeting Art. 33 of LGPD.
Without infrastructure sovereignty, there's no business sovereignty. What goes into your VPC stays in your VPC.
Our AI Ecosystem was architected from day one to be secure, auditable, and sovereign. We meet LGPD not through documents — but through network, proxy, model, and governance.
Your data never trains foundational models. What processes in the VPC stays in the VPC — guaranteed by contractual DPA and technically via LiteLLM routing.
All inference (vLLM, GPUs, databases) in BR datacenters. Data doesn't cross borders — Brazilian jurisdiction shields from CLOUD Act and meets Art. 33 of LGPD.
Before the prompt reaches the model, our proxy applies Microsoft Presidio + DLP. CPFs, CNPJs, names, and emails are automatically masked — agent works without exposing the data subject.
Every request, MCP tool, and agent response is logged immutably. When ANPD or customers request explanations, you have the complete audit trail.
AI access treated like database access. Single Sign-On + granular RBAC + unique per-user key with quotas — eliminating corporate Shadow AI once and for all.
Clear retention time per data type + on-demand deletion endpoint. Ready to fulfill data subject requests within 15 business days.
Simplified diagram of a request flow. Each step applies a control — by the time the prompt reaches the model, it's already masked, authenticated, and logged.
Request comes in authenticated via SSO, with traceable individual key. User quotas and rate limits applied before any other processing.
The proxy intercepts. Presidio removes CPF, CNPJ, email. Guardrails check topic restriction. If clear, it goes to the model. If not, policy is returned — not the LLM.
MDA LLM 2.1 (32B MoE · 3.3B active · 256k context) processes the prompt already cleaned and authorized, on GPU inside your dedicated VPC in a Brazilian datacenter. Response passes through the same filters before returning to user.
When the model sees the prompt, it's already masked, authenticated, quotas applied, and logged. Raw data never reaches the model. The model never leaves Brazil.
Compliance requires more than tech — it requires clear process. We've created an in-depth dossier with the legal and technical framework to ensure your AI operation is 100% compliant with the law.
For DPOs, Legal Directors, CIOs, and CISOs who need to unblock AI projects without exposing the company.
Aligning LGPD with AI requires interdisciplinary expertise. MDA Consulting acts as a bridge between Law and Data Engineering — we design the VPC, implement Guardrails (PII, observability), and deliver documentation for your DPO to sign.