Security
SECURITY
POLICY
Security PolicyInformation security policy
ZeroBizAX, Inc. ("we" or "the Company") believes that, as a provider of AI development, app development, AX support, business AI, and a handler of personal information, we have a responsibility to appropriately protect the information assets entrusted to us by our customers. This Policy sets out our basic principles and operational rules concerning information security.
Basic Policy Basic policy
Basic policy
Through our AI SaaS, AX Solution, and web application development businesses, we handle customers' business information and personal information. We position information security as a prerequisite for business continuity and adopt the following principles.
- 01
Ensuring confidentiality, integrity, and availability
We implement technical and organizational measures to prevent unauthorized access, leakage, alteration, and loss of the information assets entrusted to us, and we maintain a state in which only the necessary people can use them when necessary.
- 02
Compliance with laws, contracts, and social expectations
We comply with related laws and regulations (including the Act on the Protection of Personal Information, the Unfair Competition Prevention Act, the Copyright Act, the Specified Commercial Transactions Act, and the Telecommunications Business Act of Japan), contractual obligations, and industry guidelines.
- 03
Least privilege and zero trust
We design all access on the premise of "not trusting" any party. We grant least privilege according to role and duties and verify authentication and authorization in multiple layers.
- 04
Continuous improvement
We continue risk assessment, vulnerability monitoring, and operational reviews, and continuously improve security measures in response to changes in the technical environment and threat landscape.
Asset Management Information asset management
Information asset management
On the premise of building systems on cloud infrastructure, we enforce encryption, access management, and audit logging.
- 01
Cloud infrastructure
We use trusted cloud services such as Vercel and Neon as our foundation, after confirming the providers' security certifications (such as SOC 2). Production and staging environments are clearly separated.
- 02
Encryption
All communications are encrypted with TLS, and at-rest encryption provided by cloud vendors as a standard feature is enabled. Items requiring confidentiality at the application layer receive additional encryption.
- 03
Access management
Administrator privileges are limited to personnel who require them, and we use multi-factor authentication offered by administrative services. Our operating rules cover SSO, password policies, and access suspension for departing personnel, with periodic implementation reviews.
- 04
Audit logs
We record application administrative actions, authentication events, AI-feature usage, and other events available to us for suspicious-behavior detection and post-incident investigation. We manage log destinations, access rights, and retention, and continue strengthening tamper resistance.
AI Operation AI operation policy
AI operation policy
Our business is premised on the use of AI, but we never use AI output as-is for decisions. Based on the principle that final decisions are made by humans, we set operational rules that take into account the characteristics of generative AI.
- 01
Final decision by humans
Final decisions on matters that materially affect rights, obligations, or business operations — such as concluding contracts, sales judgments, and operational improvement judgments — are always made by humans. AI is limited to presenting candidates, summarizing, and verification support.
- 02
Hallucination countermeasures
We presume that generative AI output may contain information inconsistent with facts (hallucinations), and we incorporate explicit grounding, source links, and human verification steps into operational flows.
- 03
Careful application in important decision-making areas
For decision-making areas involving contracts, sales, operations, and the handling of personal information, we conduct risk assessments for each use case before deployment, and explicitly document the scope of application, prohibited uses, and human verification obligations.
- 04
Restriction on use for training
For commercial AI APIs, we select services whose official terms state that submitted data is not used for model training. We review retention periods and exceptions by plan and feature, and notify customers when a material change affects the Service's data handling.
- 05
Prompt injection countermeasures
We treat user inputs and externally retrieved information as untrusted inputs, and take countermeasures such as separation from system prompts, validation, enforcement of output schemas, and human approval before sensitive operations.
Vendors Third-party sharing and processor management
Third-party sharing and processor management
We use external cloud services to the extent necessary to provide the Services. When selecting processors, we evaluate security certifications, operational track record, and data-handling policies before adoption.
- Vercel, Inc. (United States)
- Hosting, edge network, and access analytics. We review published security information and contractual terms before use.
- Neon, Inc. (United States)
- Managed PostgreSQL. We use at-rest encryption and point-in-time recovery.
- Anthropic, PBC / OpenAI, LLC (United States)
- AI model providers. We review official commercial-API data terms and limit feature-specific transmissions to what is necessary.
- Resend, Inc. (United States)
- Transactional email delivery. SPF, DKIM, and DMARC are configured.
- Google Workspace (Google Cloud Japan G.K.)
- Operational infrastructure, email, and file sharing. We manage authentication and access settings for organizational accounts.
- Oversight
- We review processors' published DPAs, terms, and security information, and maintain a register of applicability to our plan, data categories, and retention and deletion conditions.
Incident Incident response
Incident response
To prepare for incidents such as information leaks, system failures, and unauthorized access, we set procedures for detection, response, and notification.
- 01
Detection and initial response
We detect events through audit logs, monitoring, and customer reports, and promptly isolate the affected scope, prevent the spread of damage, and preserve evidence.
- 02
Root cause analysis and permanent measures
After an event, we conduct root cause analysis (RCA) and plan and implement permanent technical and operational measures. We reflect recurrence-prevention measures in playbooks.
- 03
Notification to authorities and individuals
For matters requiring reporting to the Personal Information Protection Commission and notification to individuals under Article 26 of the Act on the Protection of Personal Information (APPI) of Japan, we respond promptly. For events that affect customer business, we communicate in accordance with contractual notification obligations.
- 04
Business continuity
We maintain backups, restore procedures, failover, and disaster recovery plans to secure continuity of critical operations.
Certification Certification roadmap
Certification roadmap
We plan to obtain third-party certifications in line with business growth. Immediately after incorporation, we prioritize building internal controls, and then sequentially pursue SOC 2 and ISO/IEC 27001 (ISMS).
- 2026
- Establishment of internal security regulations, accumulation of operational records, and risk assessments. Building of a processor evaluation process.
- 2027
- Preparation toward SOC 2 Type I. Automation of access management, audit logging, and vulnerability management processes.
- 2028 and beyond
- Maintenance of SOC 2 Type II and planned acquisition of ISO/IEC 27001 (ISMS). Additional certifications such as PrivacyMark may be considered according to business area.
Contact Contact
Contact
For questions about this Policy, vulnerability reports, and incident notifications, please contact hello@zerobizax.com. For vulnerability reports, we kindly ask that you refrain from publishing information while investigation and remediation are ongoing.
The Japanese version of this document is the legally binding version. The English translation is provided for reference only.
Last updated: July 18, 2026