shutto翻訳 security policy

1. Demarcation point of responsibility with users

Responsibilities of e-365
e-365 implements the following security measures:

• Security measures for the shutto翻訳 application
• Protection of customer data stored in the shutto翻訳 application
• Security measures for middleware, OS, and other infrastructure used to provide the shutto翻訳 application

Customer Responsibilities

You must implement the following security and privacy protection measures in accordance with your security policy and privacy policy.

• Appropriate management of passwords assigned to each user
• Proper management of shutto翻訳 services (registration, deletion, permission settings, organization administrator settings, etc.)
• Management of data generated and stored when using shutto翻訳 (translation data, text data, dictionary registration data, etc.)
• Responsibility for the use of data generated when using shutto翻訳
• Appropriate management of the handling of personal information registered with shutto翻訳 (notification and publication of purpose of use and other measures required under the Personal Information Protection Act)

2. Data storage location

As a general rule, all data is stored within Japan.
In addition, if it is difficult to store data within Japan due to the structure of the service we use, we will use it in consideration of the risks associated with storing data in that country.

3. Data Deletion

• If you decide to delete data generated and stored in the course of using the service, the data will be promptly deleted or anonymized from the database based on your actions.

• After the service agreement with the customer is terminated, customer data will be deleted. However, customer information, backup data, and log data will be stored for the following period.

• We will store logs and backups of the data to the extent necessary for the stable operation of our services, such as to respond to malfunctions or prevent fraudulent use.

• The maximum retention periods for customer information, customer data, log data, backup data, etc. are as follows:

1. 1. Customer Information

      • Trial accounts that have ended will be anonymized six months after the end of the contract.

      • After signing up, if your account is cancelled, it will be anonymized the day after your account is cancelled.

   2. Backup data

      • Stored for 2 years

   3. Log data

      • Stored for one year

4. Encryption method

• All transmission and reception of personal information and personal-related information collected when using this service will be via SSL/TLS encrypted communications.
• All customer information stored in the database (such as names, email addresses, and data used by each function) is encrypted at the disk level using standard GCP and AWS functions. Passwords are also irreversibly encrypted (hashed) and stored in the database.

5. Backup method

• All customer information stored in the database (such as name, email address, and data used for each function) is backed up daily and 35 generations of data are stored.
  However, we do not accept requests from customers regarding the restoration of backup data, etc.
• Files uploaded to shutto翻訳 are stored in highly available cloud storage. Even if data is corrupted in one location, it will be automatically repaired using redundant data.

6. Clock synchronization

7. Vulnerability Management

At shutto翻訳 , we regularly undergo vulnerability assessments of our web applications by third parties.
We regularly collect vulnerability information related to the operating systems, middleware, etc. used in our systems.
In addition, if a vulnerability patch for a component used in the system is released, it will be applied to the production environment after being verified in a test environment.

8. Security Guidelines

• When developing systems, we follow industry standards and best practices for the languages ​​we use.

• The development process is carried out in accordance with our internal coding standards.

9. Information security education

We provide necessary information security training, thoroughly inform employees about our basic policy and various regulations, and improve their literacy.

10. Response in the event of an incident

• For inquiries regarding information security incidents, please report them using the inquiry form below.

• In the event of a security incident that affects you (such as data loss or prolonged system outage), we will contact you via your contracted email address or via a News on the administration screen, aiming to do so within 72 hours of the incident occurring.

11. Inquiries regarding security, etc.