Information Security Policy

1. Purpose

In providing services such as the AI call center AIRI to local governments, public agencies, and businesses, we establish this policy to protect the information assets entrusted to us, including personal information and call audio, from leakage, tampering, loss, unauthorized access, and other threats, and to earn the trust of our customers and society.

2. Scope

This policy applies to our officers and employees (including contract and temporary staff) and to all information assets handled in our business. We also require contractors who handle our information assets to follow equivalent practices.

3. Organization

We appoint a person responsible for information security and maintain an organization to promote the measures under this policy.

4. Compliance

We comply with Japan's Act on the Protection of Personal Information, the Act on the Prohibition of Unauthorized Computer Access, and other applicable laws, government guidelines and other standards, as well as the security requirements set out in our contracts with customers.

5. Security Measures

We take the following security measures according to the importance of each information asset and the risks it faces:

• Organizational: handling rules, clear roles and responsibilities, and reviews of how they are applied
• Human: confidentiality undertakings and employee training
• Physical: control of work areas and equipment, and prevention of theft and loss
• Technical: access control, strong authentication, encryption of data in transit and at rest, protection against unauthorized access and malware, and logging

6. Training and Awareness

We continuously train all employees on the importance of information security and the rules for handling information.

7. Contractors and Cloud Services

When outsourcing work or using cloud services, we select contractors and providers after confirming their security standards, and manage and supervise them through contracts and other appropriate means.

8. Incident Response

If a security incident occurs or signs of one are detected, we promptly investigate the cause, prevent further damage, report appropriately to customers and relevant authorities, and take steps to prevent recurrence.

9. Continuous Improvement

We regularly review this policy and our measures in light of changes in our business, technology, and laws, and work to continuously improve information security.