Information Security

In the design, development, and operation of our products and services, we do not rely on the premise that “passing a specific checkpoint means it is safe.” Rather than trusting a perimeter (VPN, government agency networks, recommended platforms, and the like), we build controls in line with data minimization, least privilege, continuous verification, and assume-breach design (the Zero Trust approach).

Information security management is based on risk assessment and on the design and operation of controls aligned with the ISO/IEC 27001 (ISMS) framework. We are preparing to obtain certification under that standard; once obtained, we will add the certification scope and expiry date to this page.

We carry out the following processes on an ongoing basis.

We do not accept substitution by authority, such as “safe because it is recommended” or “safe because it is domestic-only.” Our criterion is that safety be explainable through the processes and controls above.

• Risk assessment based on assets, threats, and vulnerabilities, with residual risk recorded
• Selection and implementation of technical and organizational controls according to risk
• Evaluation and re-evaluation of cloud infrastructure (such as Google Cloud) and of contractors and downstream processors
• Investigation, notification, and prevention of recurrence in the event of an incident (including responsibility boundaries)
• Review of the effectiveness of controls

In the SaaS we provide (for example, Imaju), we adopt designs that, as far as possible, do not collect personal information or business data and do not retain it long-term. Some products limit data to the metadata required to record delivery and connection, and do not retain or forward the bodies of end-user content (see each product’s terms and policies for details).

Information obtained through this corporate site and our contact channel is handled in accordance with the Privacy Policy. Data handling for each product is governed by that product’s own documents.

We operate on cloud platforms with international third-party certification and audit track records, layering application-level controls such as authentication, authorization, encryption, logging, and rate limiting. Following risk evaluation, technical dependence on a specific government-only domestic platform is not adopted within the scope of our ISMS.

For failures, degraded operation, and security events, we distinguish detection from confirmation, and give notice and keep records to the extent necessary. Where a product has its own monitoring and notification policy, that product’s documents take precedence.

Responsibility boundaries, records, and customer notification in the event of an incident are operated in accordance with the authoritative documents. Merely “having passed a checkpoint” is not treated as discharging accountability.

For links to related legal and product documents, see below.

• Privacy Policy
• Imaju Terms / Imaju Privacy / Imaju Commerce Disclosure
• Imaju Security / Incident

This policy may be revised as necessary. Revised content takes effect when published on this Site.

Last updated: 6 September 2026