Kitasan Co., Ltd. (the “Company”) recognizes information assets entrusted to us by customers, business partners, employees, and other stakeholders as important management resources in connection with our business activities, including AI and software development, systems development, game and digital content development, and cloud services.
To protect these information assets appropriately and remain a trusted business, we implement information security measures in accordance with the following policy.
1. Management Responsibility for Information Security
Management recognizes the importance of information security, establishes the necessary management framework, and continually works to improve our security measures.
We review necessary measures in response to changes in our business, information systems, cloud services, and information assets.
2. Appropriate Management of Information Assets
We appropriately manage information assets that we own or handle, taking into account their importance and confidentiality.
In particular, we apply appropriate access controls and handling procedures to:
- Information provided by customers and business partners
- Documents, design materials, source code, and data created or acquired through our work
- Software assets managed in Git repositories and similar systems
- Data stored in cloud services
- Credentials, API keys, access keys, and other secrets
- Our sales, financial, contractual, and other management information
- Personal information and information that can identify individuals
3. Account and Access Management
We follow the principle of granting only the minimum permissions necessary to access information systems and cloud services.
We appropriately manage passwords and other credentials. Where available, we implement suitable authentication enhancements, such as multi-factor authentication, as needed.
When an employee leaves, a contract ends, or permissions change, we appropriately manage accounts and access rights that are no longer needed.
4. Security Management of Software and Systems
We appropriately apply security updates to computers, smartphones, network devices, operating systems, applications, and cloud services used for business.
We also take technical measures appropriate to the scale of our business and the risks involved to prevent damage from viruses, malware, unauthorized access, and other cyberattacks.
5. Backups and Business Continuity
We back up important business data and development assets as needed.
Taking into account risks such as ransomware, equipment failure, user error, and service outages, we strive to keep important data recoverable.
6. Use of Cloud and External Services
We may use cloud, development, and AI services from AWS, GitHub, Microsoft, Google, OpenAI, Anthropic, Unity, and other providers for business purposes.
Before using these services, we review their purpose, stored information, access permissions, authentication methods, contractual terms, and security features, and use them appropriately.
In particular, before entering or transmitting confidential customer information, personal information, source code, or other important information to external AI services, we review the applicable contractual terms, the provider’s data-use policy, and our information management rules.
7. Information Management in AI-Assisted Development
We promote software development and operational efficiency using AI.
When using AI coding assistants, generative AI, APIs, MCP, or other AI-related services, we review the confidentiality of the information to be submitted and the provider’s data handling terms to reduce the risk of information disclosure.
As a general rule, we do not enter customer-provided information, non-public source code, credentials, API keys, personal information, or other confidential information into external AI services without the necessary authorization.
8. Management of Development Assets and Source Code
We use version control systems such as Git in software development and appropriately manage source code and other development assets.
We manage credentials, API keys, private keys, and other secrets so that they are not inadvertently stored in source code or disclosed in public repositories.
When using public repositories, we check the scope and contents of publication and take appropriate steps to ensure they do not contain confidential information.
9. Protection of Personal Information
When handling personal information, we manage it appropriately in accordance with applicable laws and our personal information protection rules.
Access to personal information is limited to what is necessary for business, and we work to prevent leaks, loss, or damage.
10. Information Management with Contractors and Business Partners
When outsourcing part of our business to an external organization or individual, we confirm information security requirements as needed and strive to ensure that confidential information and personal information are appropriately managed.
Where required by contract, we clarify confidentiality obligations and other information management requirements in the relevant agreement.
11. Incident Response
If an information security incident or suspected incident occurs, including information disclosure, unauthorized access, malware infection, account misuse, or data loss, we work to contain the impact, investigate the cause, recover, and prevent recurrence.
If customers, business partners, or other stakeholders are affected, we provide appropriate communication and response as needed.
12. Compliance with Laws and Guidelines
We comply with laws relating to information security and personal information protection, contractual obligations, and other applicable rules and guidelines.
We also refer to information security guidelines published by organizations such as the Information-technology Promotion Agency (IPA) and implement measures suited to the scale and nature of our business.
13. Education and Awareness
We provide officers, employees, and, as needed, contractors with necessary information security education and alerts.
We strive to ensure that they work with an appropriate understanding of phishing, unauthorized access, malware, password exposure, misdirected information, and information disclosure when using AI services.
14. Continuous Improvement
We periodically review the implementation of our information security measures and changes in the information security environment, and revise this policy and related measures as needed.
We do not treat security measures as a one-time effort; we continually improve them in response to changes in our business environment, technology, and threats.
15. Publication of This Policy
We publish this policy on our website to clarify our fundamental approach and initiatives regarding information security.
Representative Director
Established: October 1, 2026