This is an English translation of Exceed One's Information Security Policy. The authoritative Japanese version prevails in case of any discrepancy.
Security Management Regulations enacted: May 23, 2018
Exceed One Co., Ltd. (hereinafter "the Company") develops and sells products that protect files, and provides support for cloud deployment, development and operations. The Company considers protecting information entrusted by customers and its own information assets to be one of the most important aspects of continuing its business, and hereby establishes the following Information Security Policy.
On May 23, 2018, the Company established "Security Management Regulations" as part of its personal information protection management system, and has been managing information security on that basis. This policy summarizes those efforts as an information security policy that covers not only personal information but information security in general, and makes it public.
1. Compliance with laws and regulations
The Company complies with laws and regulations relating to information security, guidelines established by the national government, other norms, and contractual obligations with customers.
2. Management structure
The Company appoints a person responsible for information security, and establishes a structure for the appropriate management of information assets and for reporting and responding when issues arise.
3. Protection of information assets
To prevent unauthorized access, leakage, alteration, loss and damage of information assets, the Company implements security measures suited to the realities of its business from organizational, personnel, physical and technical perspectives.
- Organizational: Define who handles information and the scope of handling, and verify the handling status.
- Personnel: Obtain confidentiality agreements from employees and provide regular training.
- Physical: Manage entry and exit in areas where information is handled, and prevent theft and loss of devices and recording media.
- Technical: Implement access controls and user identification/authentication, and protect information systems from unauthorized external access and malicious software.
4. Training
The Company communicates the importance of information security and the rules to be observed to all officers and employees, and provides regular training.
5. Incident response
When an information security incident occurs or there is a risk of one, the Company responds immediately to minimize damage, investigates the cause and prevents recurrence. If customers are affected, they will be notified promptly.
6. Products and services we deliver to customers
The Company's products and services are designed with the goal of protecting customers' information. Information security is also considered in their development and delivery.
7. Management of subcontractors
When outsourcing work, the Company selects subcontractors that maintain an adequate level of information security, and manages them appropriately.
8. Continuous improvement
The Company periodically reviews this policy and its practices, and continues to make improvements.
The Company holds the Privacy Mark (Registration No. 21004578(04)) for personal information protection. For details on the handling of personal information, see our Privacy Policy.
Exceed One Co., Ltd.
Representative Director: Seiji Noro