Security Policy (Information Security Basic Policy)

1. Basic Policy

This Office ensures information security in accordance with the following principles, in compliance with the Administrative Scrivener Act, the Act on the Protection of Personal Information, the Act on Prevention of Transfer of Criminal Proceeds, and other applicable laws and regulations.

1. Information entrusted by clients shall be appropriately acquired, used, and managed within the scope necessary for the performance of services.
2. Organizational, personnel, physical, and technical safety management measures shall be implemented to ensure the confidentiality, integrity, and availability of information.
3. The Representative Administrative Scrivener shall continuously study information security and the protection of personal information, and, when this Office has employees, shall provide them with training.
4. Appropriate selection and supervision shall be conducted with respect to external contractors and the services used.
5. In the event of an information security incident, prompt action shall be taken and measures to prevent recurrence shall be implemented.
6. This Policy and related procedures shall be continuously reviewed and improved.

2. Information Security Manager

The Information Security Manager of this Office is the Representative Administrative Scrivener. The Representative Administrative Scrivener bears ultimate responsibility for the development, implementation, and supervision of safety management measures based on this Policy.

3. Organizational Safety Management Measures

• Internal regulations regarding the handling of personal information and confidential information shall be established and reflected in operational practices.
• The handling status of information assets shall be periodically inspected and improved as necessary.
• Procedures for reporting and responding to information security incidents shall be established.

4. Personnel Safety Management Measures

• When hiring employees, this Office shall require the submission of pledges concerning the duty of confidentiality under Article 12 of the Administrative Scrivener Act and the handling of personal information.
• When this Office has employees, information security training shall be provided to them upon joining the Office and on a periodic basis thereafter.
• The duty of confidentiality with respect to information learned in the course of duties shall continue to apply after retirement or termination of employment.

5. Physical Safety Management Measures

• The entrances and exits of the Office shall be managed with locks, and access to work areas shall be controlled.
• Documents containing personal information shall be stored in lockable cabinets or similar facilities.
• Measures to prevent loss and theft shall be taken with respect to business equipment (PCs, smartphones, etc.).
• Documents and recording media no longer required shall be disposed of in an unrecoverable state through shredding or specialized disposal processes.

6. Technical Safety Management Measures

• Operating systems and software on business equipment shall be kept up to date, with security updates applied in a timely manner.
• Anti-virus software shall be installed on business equipment.
• Passwords that are difficult to guess, PINs, or passkeys shall be set for business accounts (Google Workspace, various cloud services, etc.), and two-factor authentication shall be enabled wherever possible.
• Electronic data containing personal information shall be managed in designated storage locations on business computers and on a business cloud platform (Google Workspace), with the persons who may handle it limited to the minimum necessary.
• Personal information related to business shall not be stored on personal devices (private PCs, personal email accounts, etc.).
• When this Office sends files containing personal information, it shall do so via shared links from business storage (limited to the intended recipient) or by other secure means. Files sent to this Office by clients shall be moved to a designated storage location and then promptly deleted from the channel used to receive them.
• With respect to the office website (kokusaihome.com), communications shall be encrypted via SSL/TLS, and security plugins shall be employed for protection against unauthorized access.

7. Management of External Contractors and External Services

The external services used by this Office in operations are as set forth in Section 5 of the Privacy Policy. This Office manages these services as follows.

• The privacy policies and security standards of service providers shall be reviewed, and providers shall be appropriately selected.
• The status of service usage shall be periodically reviewed, and services shall be changed, added, or discontinued as necessary.
• If this Office becomes aware of a serious security incident at a service provider, the continued use of the service shall be promptly reconsidered.

8. Policy on the Use of AI (Generative AI) Services

(1) Use of Translation Services

• For translating text containing personal information, we use paid translation services whose providers publicly state that input is not used for training and is not stored after translation is completed, or translation functions processed on the device. Translation by generative AI is governed by (2).
• Translation services that may use input for training or store it (free web translation, translation apps set to save history to an account, etc.) are not used for work involving personal information.
• When using conversation translation functions in meetings, etc., priority is given to settings that process on the device (downloaded languages). When using translation on external servers for languages that cannot be processed on the device, history and audio are set not to be saved, and personally identifiable information such as names, dates of birth and various numbers is not entered into the translator.

(2) Use of Generative AI (Claude, etc.)

• This Office uses generative AI for research on business knowledge, drafting and proofreading of documents, translation, assistance in drafting messages to clients, etc.
• Client personal information is entered into generative AI only to the extent necessary to perform the services requested and to respond to consultations. Individual Numbers (My Number) are not entered. Particularly sensitive information, such as criminal records and medical history, is kept to the minimum necessary for the work.
• The generative AI we use is used under settings or contracts under which input is not used for AI training (except where content detected as possibly violating the provider’s terms of use is used for the provider’s safety measures). This Office periodically checks that these settings are maintained. The countries in which input is processed and the retention period are described in Section 7 of the Privacy Policy.
• Client personal information is not entered into generative AI services (free versions, etc.) for which the settings or contracts in the preceding item cannot be confirmed.
• Output from AI services is never transmitted externally as-is and must be reviewed and corrected by the Representative Administrative Scrivener before use.

9. Incident Response

In the event that an information security incident occurs, including but not limited to the leakage, loss, or damage of personal information, or where the risk of such occurs, this Office shall respond as follows.

1. Promptly investigate the facts and take emergency measures to prevent the expansion of damage.
2. Promptly notify the affected clients.
3. Where the requirements set forth in the Act on the Protection of Personal Information are met, report to the Personal Information Protection Commission and notify the individuals concerned.
4. Analyze the cause and develop and implement measures to prevent recurrence.

10. Training and Continuous Improvement

• The Representative Administrative Scrivener shall continuously study information security and the protection of personal information, and, when this Office has employees, training on information security and the protection of personal information shall be periodically provided to them.
• This Policy and related procedures shall be continuously reviewed and improved in light of changes in laws and regulations, changes in the scope of services, and changes in the technical environment.

11. Revision of This Policy

This Office may revise this Policy as necessary. The revised Policy shall take effect from the time it is posted on the website of this Office (kokusaihome.com).