Information Security Policy

01Scope and Accountability

This policy applies to the Company’s officers and everyone engaged in its work, to our subcontractors, and to every endpoint, cloud service, source repository and credential used in the course of our business.

The Representative Director is accountable for information security. The accountable owner maintains this policy, corrects violations, and makes decisions in the event of an incident.

02Data Classification

We classify the information we handle into four categories and vary our handling accordingly.

Client confidential data and credentials receive the strictest handling under this policy. Where the classification of a piece of information is unclear, it is treated as the higher category.

03Access Control and Least Privilege

• Access to client confidential data is limited to the people assigned to that engagement
• Privileges are granted only at the minimum level required to do the work. When using an external service’s API we request only the scopes the purpose requires, and obtain write permissions only where they are needed
• Data belonging to different clients is never commingled in storage or processing; it is kept and handled separately for each client
• Privileges are reviewed when the nature of an engagement changes and when it ends, and anything no longer required is promptly removed

04Handling of Credentials

• API keys, secrets and access tokens are never written into source code. They are kept outside the repository and managed in the operating system credential store or in encrypted environment variables
• Passwords are unique per service, generated and stored in a password manager. Reuse is prohibited
• Multi-factor authentication is enabled on every service that supports it
• Credentials are never left in chat, email, meeting notes, logs or screenshots
• Credentials are promptly invalidated at the end of an engagement and whenever exposure is suspected

05Endpoints and Network

• Endpoints used for our work run antivirus software with real-time protection and automatic definition updates enabled
• Security updates for operating systems, browsers and runtimes are applied automatically
• Disk encryption is enabled on endpoints
• Screens lock automatically after a period of inactivity and require authentication to resume
• We operate no servers that hold client data. Our public websites are static pages on managed shared hosting and contain no client data. Work is performed against managed cloud services over TLS, and no service is exposed to the internet from our endpoints

06Encryption in Transit and at Rest

Client confidential data and credentials are encrypted both in transit and at rest. In transit we use TLS 1.2 or higher, including for API traffic with external services. At rest, protection is provided by disk encryption on endpoints and by the encryption applied by the cloud services we use.

07Subcontractors and External Services

We use external services, and may subcontract work, to the extent necessary to perform an engagement. In such cases we verify the suitability of the service or subcontractor, conclude confidentiality and security agreements, and exercise necessary and appropriate supervision. The principal external services we use are listed in our privacy policy.

Where AI services are used in our work, they are used under settings or terms under which the input is not used to train models.

08Incident Response

Anyone who detects a leak, loss, corruption or unauthorised access to information, or the risk of one, reports it to the Representative Director without delay. The accountable owner then acts in the following order.

1. Stop the damage from spreading (invalidate the credentials concerned, cut the connection)
2. Determine the scope of impact (which data, which clients, which period)
3. Report to the affected clients without undue delay
4. Notify the Personal Information Protection Commission or other authority where required by law
5. Establish the cause and fold the corrective measures back into this policy or our procedures

The reporting and contact point is kanemichi@schoole.co.jp.

09Vulnerability and Threat Management

• Security updates for operating systems, browsers and runtimes are applied automatically
• We monitor the security advisories of the platforms we integrate with and respond promptly where we are affected
• Third-party libraries used in the programs we write are kept current and reviewed when an advisory affects them
• Access tokens are rotated at the end of an engagement and whenever exposure is suspected

10Retention and Deletion

Data entrusted to us is retained only for the period necessary to achieve the purpose of use. Upon termination of a contract, the data and API access tokens we hold are deleted within three months, except where retention is required by law. Where a client requests deletion, we delete promptly and confirm that we have done so.

Clients may revoke the connection to our application at any time from the administration console of the external service concerned. From the moment of revocation we cease obtaining any new data through that API.

11Review of This Policy

This policy is reviewed at least annually, and whenever there is a material change in our business, in the services we use, or in applicable law. Where we revise it, we publish the revised policy and the date of revision on this page.

12Contact