Information Security Policy
Effective: 21 September 2026
As a company entrusted with client information assets, ELYSAI Co., Ltd. works to ensure information security under the following policy.
01Basic policy
We treat information entrusted to us by clients, together with our own information assets, as critical business assets, and work to preserve their confidentiality, integrity and availability.
02Scope
This policy applies to all of our operations and personnel, and to partners to whom we subcontract work.
03Handling of client information
Information received from clients is used only within the agreed purpose, under a confidentiality agreement. On completion of an engagement it is returned or deleted according to the client’s instructions.
04Access control
Access rights to systems and data are limited to what each role requires. Multi-factor authentication is used, and access is revoked promptly when responsibilities or contracts end.
05Security in development
・No production change is deployed without code review ・Dependency vulnerabilities are checked continuously ・Credentials are never committed to source code ・Production data is not brought into development environments
06Use of generative AI
We use generative AI in our development process. We do not input client confidential information into external generative AI services beyond what the client has permitted. The services used and their settings are agreed with the client for each engagement.
07Management of subcontractors
Where part of the work is subcontracted, we require security measures equivalent to our own and conclude a confidentiality agreement before doing so.
08Incident response
If we become aware of a security incident or the risk of one, we report it to the client promptly and work to determine its scope and cause and to prevent recurrence.
09Continuous review
We review this policy and the related practices periodically in line with changes in our business environment and in technology.