What to ask a Brazilian security vendor — and when

Why phases exist

But before any phase, start with the question that actually defines a vendor: is there a single accountable principal who owns the intelligence, planning, command, secure transport and concierge — and who stands behind the entire operation, end to end? And does that principal assure you that all armed protection is performed by Polícia Federal-authorized providers under its command? That is the gold-standard question. It satisfies the legality concern as an assurance the provider gives — rather than turning you into the investigator who has to extract an Alvará number from whoever holds the licence.

Most "how to hire security" guides skip that question and treat procurement as a flat checklist of documents to extract. You send the vendor a seven-item request — certificate of insurance, agent name and background, vigilante registration number, vehicle plate, armor class — and expect all of it at once. When you're negotiating a 14-day multi-principal operation with a vetted threat profile, some of that is appropriate. When you're booking a one-way airport transfer, it's a mismatch — and it forces the vendor to release sensitive information about individual agents before any contractual commitment exists.

Timing-aware due diligence solves the second part. Each phase of the procurement cycle releases what's appropriate to the current commitment level. You confirm accountability and service scope before signing anything. You verify the policy and vehicle after engagement is formalized. You verify the specific plate and agent on day-of pickup. This protects both sides: the buyer gets the information they need when they need it, and the vendor doesn't leak agent opsec without contractual cover.

Why the vigilante number is different

It's worth calling out the vigilante card explicitly because it's the item most commonly requested prematurely in due-diligence pings. The card is a Polícia Federal-issued document under Brazil's private security regulatory regime. Unlike a corporate PF authorization — which credentials a company — the vigilante card credentials an individual, and the associated registration links to the agent's home address and personal data.

On a low-visibility corporate engagement, agents operate on deniability. Releasing the vigilante card number to a buyer who hasn't yet contracted the service means handing over PII linked to someone the agent has no client relationship with. For the responsible vendor, that's a risk that justifies refusing — not because they have anything to hide, but because the agent is a third party who deserves protection. Request it only when a regulation or legal jurisdiction explicitly requires it, and even then, prefer verifying the company's regulatory posture via PF over the individual's card.

What this framework protects

Structuring due diligence by phase does four things. First, it protects agent opsec — you're not asking an individual agent to be exposed to a buyer who hasn't yet committed. Second, it makes your process look professional in the vendor's eyes — you're signaling that you understand the procurement cycle in Brazilian private security. Third, it gives the vendor less reason to inflate prices defensively — generic upfront asks often trigger defensive pricing because the vendor can't scope the work. And fourth, it lets the vendor respond in kind — you get more accurate answers, instead of the evasive answers a vendor produces when you ask for everything at once.

For the engagements where the full checklist is justified — multi-principal operations, high-threat environments, government engagements — you can still ask for everything. The difference is that in those contexts the disclosure makes sense because the size and profile of the contract justifies the exposure. The point is not to never ask for the sensitive information; it's to ask for it when the corresponding commitment is in place.