White-space

A test mirror for experimenting without touching production. What's done in the sandbox does NOT reflect in production, and vice versa; confusing the two means publishing a test or testing on real data — check which environment you're in before acting.

Each blocked send goes into a list with destination, subject and time. That's deliberate: if the trainee doesn't see the message being blocked, they learn that "the system doesn't send email" — and on their first day in production, they send one.

The sandbox has a deadline (30 days by default, SANDBOX.DIAS_VALIDADE parameter). When it expires the account goes back to production and whoever administers it is notified. A training environment without a deadline becomes a permanent environment with real data inside.

Masked CPF and CNPJ keep the number of digits so the screen keeps validating the format, but the number isn't valid. That's deliberate: generating a valid document in training would teach the operator to trust a number that doesn't exist.

Whoever created the copy enters it by switching companies in the selector at the top of the screen. To give access to someone else, use Settings ▸ Access inside the copy, as in any company. Access groups are copied, so permissions arrive already similar to those at home.

The mode had existed since 2025 and showed the yellow banner, but no outbound channel checked it: collection emails, WhatsApp and webhooks kept going to real customers. If you trained someone in sandbox mode before this date, assume the messages really went out.

Email, WhatsApp, webhook, collection, fiscal issuing and push notification. The list is the SANDBOX.CANAIS_TRAVADOS parameter — removing a channel from it makes the sandbox send through it again, so it's only changed with a written reason.

Before this version, "training someone" meant turning on training mode IN YOUR company and trusting that nobody would click send. Now there's the copy button: it creates a new company, in your same group, with your records and your transactions — and your real company stays in production, intact.

Name, legal name, email, phone, document, address and PIX key are replaced by fictitious values — always the same fictitious value for the same original, otherwise the same customer would appear with three names and the training would lose its point. Password, token, API key and certificate are NOT copied: they stay empty, because copying something encrypted is copying the credential. Attachments, sent emails, issued invoices and the audit trail don't go either — training doesn't need them, and each one would be duplicated sensitive data.

Not yet. Today the sandbox turns the account ITSELF into a training environment — which works for training without risk of leaks, because nothing goes out. A separate copy with masked data depends on a company clone the platform doesn't have yet, and cloning halfway would deliver an environment that looks like the company and behaves like a broken company.

It deletes it. The copy is born marked as a copy, and when the deadline expires it's deleted along with its data. A real company in training mode has a different outcome: it just goes back to production. They're two paths kept separate on purpose — returning a copy to production would leave a database with copied data and outbound sending enabled.