Information Security Policy

1. Basic Information Security Policy

TECPRESSO Inc. has responded to customer needs through internet engineering services. To continue providing products and services that satisfy our customers, we establish this Information Security Policy as a guideline for protecting information assets from threats such as accidents, disasters, and crime, and for meeting the trust of our customers and society.

1. Internal structure and security rules

We establish a management structure necessary to maintain and improve security, and define necessary information security measures as formal internal rules.

2. Leadership responsibility and continual improvement

Management leads the organization so that our own and our customers' information assets are appropriately managed in accordance with this policy.

3. Compliance with laws and contractual requirements

Employees comply with laws, regulations, norms, and contractual security requirements related to information assets used in business activities.

4. Employee commitment

Employees continuously acquire the knowledge and skills necessary to maintain and improve information security.

5. Response to violations and incidents

We maintain a structure for responding to violations and information security incidents related to laws, regulations, norms, and contracts, and work to reduce their impact.

2. Information Security Policy for Cloud Services

In providing and operating cloud services, TECPRESSO Inc. defines the following supplementary cloud security guidelines to protect customer information assets and provide safe, reliable services continuously.

1. Clarification of responsibility sharing

For cloud services, we clarify the division of responsibility between the cloud service provider and customers, and implement security measures based on contracts and specifications.

2. Response to cloud-specific security risks

Considering cloud-specific technical conditions such as multi-tenant environments and virtualization, we implement appropriate measures including access control, data separation, and network separation.

3. Encryption and control of information in the cloud

We protect communication paths and control management interfaces as basic measures, and implement appropriate controls such as stored-data encryption according to service characteristics and requirements.

4. Visibility and auditability in cloud operations

We maintain appropriate logging, retention, and audit capabilities in cloud environments and provide mechanisms that allow customer audits when necessary.

5. Understanding and compliance with cloud-related legal and regulatory requirements

We understand and appropriately manage legal and regulatory requirements specific to cloud services, including data location, cross-border transfer, and third-party involvement.