Information Security Policy

1. Scope

This policy applies to Typing Musou as provided by us, including the learning feature 'Joho Musou' and the school edition (the 'Service'), and to the servers, work devices, accounts and processors used to run it.

2. Organization

The Service is run as a sole proprietorship. The representative serves as the person responsible for information security and carries all of the responsibility for providing the Service, for administering the systems, and for day-to-day operations. There are no employees, and only the representative is granted access to the production environment and to information entrusted to us by schools.

3. Compliance

We comply with Japan's Act on the Protection of Personal Information and other applicable laws, and with our own Terms of Service, Privacy Policy, and document on the handling of personal information in the school edition. Information received from Google APIs is handled in accordance with the Google API Services User Data Policy, including the Limited Use requirements. For the school edition, we carry out a self-assessment against the items for cloud service providers in the Ministry of Education, Culture, Sports, Science and Technology's Guidelines on Educational Information Security Policy.

4. What we do

To preserve the confidentiality, integrity and availability of information, we do the following. The specific measures are set out in Section 12 of 'Handling of personal information in the school edition'.

• Least privilege — We limit who can access information, and to what extent, to the minimum their role requires. The accounts the operator uses are protected by two-step verification, and the administration screens additionally require verification on the operator's own device.
• Protection in transit and at rest — Communications are encrypted, and the most important information we store is encrypted at rest.
• Logging and monitoring — We collect and retain records of access and operations, and continuously monitor the availability of the Service and changes on the servers.
• Preparing for loss — We take regular backups of the database and have a documented recovery procedure.
• Not leaving weaknesses unaddressed — We follow vulnerability information for the software we use and apply updates.
• Work devices — We limit the devices used for operations and keep them protected with disk encryption, operating-system updates and anti-malware measures. Production data is copied to a work device only to the extent needed to deal with an outage, an inquiry or abuse, and is deleted within 30 days after the work is done.
• Processors — We choose processors after reviewing their policies on handling information, and list them in our Privacy Policy. The AI assistant tools used in the operator's work are used with settings under which the content entered is not used for training. They may be given information entrusted to us by schools in the course of development, maintenance, and related work; the scope and conditions are published in §8 of "Handling of personal information in the school edition".

5. Incident response

We have a documented procedure for leaks, loss, or damage of personal data and other incidents, or the risk of them. When an incident occurs we contain it, investigate the cause, and prevent recurrence. Schools are notified as set out in Section 13 of 'Handling of personal information in the school edition'; general users are informed through in-service notices and our official X account. Where the law requires a report to the Personal Information Protection Commission, we make it.

6. When the representative is unavailable

No one other than the representative can run the Service in their place. So that the Service keeps running and schools' records are not lost while the representative is unavailable, we have arranged the following.

• The Service keeps running — Backups and availability monitoring are automated, so the Service keeps running without the representative's daily work.
• Records can be exported at any time — Teachers can export rosters, progress and gradebooks as CSV at any time, without going through the representative.
• Planned absences are announced — When an absence of 7 days or more is known in advance, we announce it beforehand in the Service and by email to the contact person at each contracted school.
• Inquiries are answered on return — Inquiries received while the representative is unavailable are answered in order after their return.
• If the school edition is discontinued — As set out in Article 10 of the Terms of Service, we give at least 6 months' notice and keep records viewable and exportable as CSV for 90 days after the end date.

7. Learning, self-assessment and review

At least once a year, the representative studies information security and personal-information protection, checks whether this policy and the internal operating rules are being followed, and carries out a self-assessment of the Service's web vulnerabilities. Based on the results, and on changes in the law or major changes to the Service, we review this policy and what we do. We have not received any third-party information-security certification, audit, or vulnerability assessment.

8. Reporting a vulnerability

If you find a vulnerability in the Service, please let us know by email ([email protected]) or through the contact page. We will look into it, fix what needs fixing, and let you know the outcome. Reports can also be made through the vulnerability reporting service of Japan's Information-technology Promotion Agency (IPA). When reporting, we ask that you:

• Tell us what you found — the affected screen or URL, the steps to reproduce it, and the likely impact.
• Leave other users' data alone — do not view or change other users' accounts or information to confirm the issue. If you come across such information, stop using it and tell us.
• Do not disrupt the Service — do not test in ways that could interfere with the Service, such as sending large volumes of traffic.
• Disclose after the fix — please do not make the details public until the issue has been fixed.

9. Contact

For questions about this policy, please use the contact page.