Informing securely, for compliance and credibility

In listed companies, the investor relations team handles information that moves share prices before the market sees it: results before release, material facts, and board and shareholder meeting materials. MZ Private gives that team a secure document-sharing workspace to keep these documents and share them with the right users, inside the company and with investors and stakeholders.

In 2023, the stakes around this information were high. CVM Resolution 44, in force since September 2021, requires officers and employees to keep material information confidential until it’s disclosed, and to make sure their subordinates and trusted third parties do the same, with joint liability if they don’t. If the information escapes the company’s control, it must be disclosed immediately. At the same time, Brazil’s data protection law (LGPD) moved from text to enforcement: sanctions have applied since August 2021, and in 2023 the ANPD published its sanctions regulation, in February, and issued its first fine, in July.

Before MZ Private, these documents traveled by email, shared drives, and personal devices. Every forward created a copy no one controlled. Access depended on remembering who had received what. And when something leaked, there was no record to answer the question the rules imply: who had access?

The product was born from that context, without a formal discovery phase, so the rules of access had to be right from the start. The challenge was to make control the default without making sharing hard: an IR team should share as easily as in the tools they already used, while the product made sure every document had a defined audience and every action left a trace.

From June to November 2023, I was the UX/UI designer on MZ Private, in a squad with 3 senior developers and a PO.

• Defined the user journeys and the access rules behind them.
• Designed the flows and prototypes, from structure to high fidelity, and the MZ Design System.
• Handed off to development and ensured quality with the developers, testing every flow in staging, in rounds of adjustments before release.

Nine decisions shape how MZ Private balances ease and control.

Permissions are assigned to groups rather than individual users. To share a folder or a file with someone, that user has to be in a group, and the group gets the access. Groups give much more control over permission levels: the board, a set of investors, and the internal team each get their own level, and changing a group once updates everyone in it.

• No member without a group. Any change that would leave someone without one blocks the “Save” button.
• A fixed “Administrators” group comes by default, can’t be renamed or deleted, and is the only one with access to “Analytics” and “Audit.”
• Members and groups, both ways. One screen shows a member and their groups; the other, a group and its members. Invitations go by email, up to 25 at a time, with the groups chosen in the same step.

Each group gets one of two permissions on a folder or file: view, to open and read, or edit, which also allows renaming, deleting, and granting access to others. Two clear levels separate the users who consume information from the users who manage it. Access is set group by group in the same window, which also creates a new group on the spot when the right one doesn’t exist yet, with a required name and description, so sharing never hits a dead end.

The first level, “Documents,” holds only folders, so every file lives inside a folder with predefined access permissions. From the second level on, users can add both folders and files, which is why “New Folder” becomes “Add.” Breadcrumbs show the path, always starting at “Documents,” and take users back to any level in one click; long names get tooltips.

The + in the top right corner adds what makes sense where the user is. In “Documents,” it uploads files or folders, or creates a folder at the current level. In “Members and Groups,” the same + adds a member or creates a group. One place to look, and an action that always fits the screen.

Folders and files share a details panel on the right: who created the item, the groups with access, and actions to rename, delete, and manage access. When a level opens, the panel animates in so users always have quick, practical access to the folder’s or file’s information, especially the users who manage access. With nothing selected, its empty state prompts users to select a file or folder. Information about any folder or file is always one click away, without leaving the list.

Grid cells don’t have room to show every action, so the grid uses a kebab menu: “Open,” “Details,” “Share,” “Copy link,” and “Delete.” List rows have room, so extra actions, like details and sharing, appear right on hover. In both, double-click opens the item, as in Google Drive. The same needs, solved the way each view’s space allows.

Files open inside the product, in viewers for PDF, video, images, audio, and text, with download always available at the top. Users read, watch, and listen without needing a copy on their machine first.

Administrators see every event in the app: who did it, what they did, which file it refers to, where that file is, and when. Replying to a comment, sharing or deleting a file, creating or downloading a version, adding or removing a user: it all lands in one list, filtered by period and group, searchable by user, and exportable in full.

When a stock trades atypically, CVM Resolution 44 asks the investor relations officer to question the people who had access to the information. This list is where that starts.

Analytics gives IR a view of how the files it makes available to investors and stakeholders are performing. Usage highlights show uploads, files accessed, and daily and weekly access. Limits show storage and users against the plan, since each plan sets both limits. The most accessed files rank documents by day, week, or month, and engagement shows how each recent upload was received, as percentages or access counts, next to the most active users.

Security needs to be visible and in users’ hands, not buried in settings no one opens.

• Login with a one-time code sent to the user’s email.
• Two-factor authentication by email or by an authenticator app, set up with a code or a QR code.
• Password changes ask for the current password and a confirmation.
• Data retention. Users choose a period, from 6 months to 3 years or a custom one, after which their data is deleted, with a confirmation step and a clear warning about what happens afterward.
• Notifications for new files, comments and replies, new members, and a monthly report, turned on or off one by one or all at once.

Together, the rules keep the room safe without asking users to remember anything.

MZ Private uses the MZ Design System. It was the first product to adopt it, a design system I created and maintained for other apps as well.