PulseOur security standards
Encryption, access control, the certifications we hold, and our policy on disclosing third-party assessments.
This explains how UNCHAIN, Inc. protects the data held in Pulse, following the categories of security control measures required by the Act on the Protection of Personal Information. You can use it as background material for your IT department's processor assessment or for answering security questionnaires.
Within this help centre, the detail of each category of security control measure, and the certifications and third-party assessments we hold, are collected in this article. Other articles give only the conclusion and a link here.
The security control framework
This requires necessary and appropriate measures to be taken to prevent the leakage, loss or damage of personal data and otherwise to manage it securely. The guidelines break those measures down into: establishing a basic policy, putting handling rules in place, organisational security measures, personnel security measures, physical security measures, technical security measures, and understanding the external environment. The measures taken have to be put where the individual can find them.
UNCHAIN, Inc. has established a basic policy on the handling of personal data, put handling rules in place covering each stage from acquisition to deletion, and implements the measures below.
Write each section below to match UNCHAIN, Inc.'s actual practice. Do not list measures that are not implemented — remove them, or word them so that it is clear they are planned.
Organisational security measures
- We designate a person responsible for the handling of personal data, and make the scope of authority and responsibility clear
- We identify which employees handle personal data and the categories of personal data they handle
- We keep records of system use, of the granting, changing and removal of permissions, and of data taken out, so that handling can be reviewed
- We have reporting arrangements in place for where a breach of the handling rules, or an indication of one, is identified
- We review handling periodically and report the results to the responsible person
- We have documented procedures for a leak of personal data, including the deadlines for reporting and notification. The process is described under “If a leak occurs” in Security and privacy FAQs
Personnel security measures
- We have confidentiality agreements with all employees. The obligation continues after employment ends
- We provide training on the handling of personal data on joining and periodically thereafter
- Permissions are granted only to the extent needed for the work, and are reviewed promptly on transfer or departure
We handle the secrecy of communications in line with the framework of the Telecommunications Business Act.
The secrecy of communications being handled by a telecommunications carrier must not be violated, and people engaged in the telecommunications business owe confidentiality obligations both during and after their employment. Breach carries penalties. We treat the parts of Pulse that mediate exchanges between users — sharing and notification features — as subject to that provision. UNCHAIN, Inc.'s officers and employees do not acquire, use or disclose information subject to the secrecy of communications learned in the course of their work, except where required by law or where there is other justifiable cause.
Confirm UNCHAIN, Inc.'s current position under the Telecommunications Business Act with the legal department. Before stating definitively that a filing has been made or is not required, that needs checking together with whether there are features that mediate other people's communications, such as mention notifications or direct messages.
UNCHAIN, Inc. keeps the position of each feature it provides under review against the Telecommunications Business Act and the Ministry of Internal Affairs and Communications' “Manual on Entry into the Telecommunications Business (Supplement)”. Where we provide a feature that mediates messages between users, we complete the necessary procedures, including the filing required by Article 16 of that Act.
Physical security measures
- Pulse's servers are housed in data centres with entry controls, monitoring, and redundant power and air conditioning
- Disk encryption and screen locking are mandatory on devices used for work
- We have procedures for carrying equipment or electronic media containing personal data
- When equipment and electronic media are disposed of, data is erased by a method that prevents recovery
Technical security measures
| Category | Detail |
|---|---|
| Encryption in transit | communication between devices and servers is encrypted with TLS |
| Encryption at rest | stored data is held encrypted |
| Access control | users of information systems handling personal data are identified and authenticated, and permissions are limited to what the work requires |
| Authentication | authentication is delegated to the connected identity provider. Enable multi-factor authentication on your identity provider |
| Logging | records of system use and access are captured and retained for a period |
| Vulnerability management | the software we use is kept up to date, and we check continuously for known vulnerabilities |
| Protection against unauthorised access | mechanisms to prevent unauthorised external access are in place and monitored |
The precise scope of access control, the monitoring methods, and the detail of measures preventing unauthorised access are not set out in this article, because publishing them could prejudice security. The Enforcement Order of the Act on the Protection of Personal Information permits such matters to be excluded from what is published. Where detail is needed for a processor assessment, we explain it individually on the basis of a non-disclosure agreement.
Understanding the external environment
Where personal data is handled in a foreign country, the data protection regime of that country has to be understood and necessary and appropriate measures taken. In Pulse, data is stored in a Japanese region as a rule, and some processing, such as generating summaries, may be delegated to providers outside Japan.
In that case, UNCHAIN, Inc. documents three things.
- the name of the country where processing is delegated
- an understanding of that country's personal data protection regime, including any regime governing government access to data
- the measures taken in the light of that understanding. These include encryption in transit and at rest, contractual undertakings that data submitted is not used other than to generate a response, and limits on retention
The names of the destination countries, an outline of the measures the destination providers take, and how often and by what means UNCHAIN, Inc. verifies them, are provided on request. The list of countries and the measures taken are published under “Provision to third parties in foreign countries” in our Privacy policy.
Managing processors and sub-processors
Where UNCHAIN, Inc. delegates the handling of personal data externally, we set criteria for selecting the processor, establish by contract the security measures to be implemented and the conditions for sub-processing, and review their handling periodically. The same conditions are imposed on sub-processing.
On business plans, UNCHAIN, Inc. acts as a party to whom the customer has delegated the handling of personal data. As part of supervising us as a processor, we recommend customers review this article and the data processing addendum (DPA). The addendum is published at Data processing addendum.
Certifications and third-party assessments
Confirm what is held with UNCHAIN, Inc.'s information security officer and keep only statements that match reality. Misstating a certification or compliance status is a critical problem. If you cannot confirm it, do not mention certification at all. The principles for wording are as follows.
- Do not write “ISO 27001 compliant”, “ISMS compliant” or “equivalent to a Privacy Mark” without holding the certification. ISO/IEC 27001 is binary — you hold it or you do not — and there is no way for a third party to verify an intermediate state of “compliance”
- SOC 2 is an audit report, not a certification. “SOC 2 certified” is wrong; write “we hold a SOC 2 Type II report”
- ISO/IEC 27017 is an add-on certification to ISMS certification; ISO/IEC 27018 is a code of practice
- Do not present the certifications of the cloud provider supplying the infrastructure as UNCHAIN, Inc.'s own. Where you mention them, make the subject explicit: “the cloud infrastructure Pulse runs on is provided by a provider holding X”
The table below sets out the nature of each scheme and UNCHAIN, Inc.'s position. Replace the 〔 〕 entries with what you have confirmed. For schemes not held, you cannot write “compliant”, “equivalent” or “meets the criteria”.
| Scheme | Nature | Status |
|---|---|---|
| ISMS certification (ISO/IEC 27001 / JIS Q 27001) | third-party certification against the international standard for information security management systems | 〔held / applied for / not held〕 |
| ISO/IEC 27017 | a standard on controls specific to cloud services, held in addition to ISMS certification | 〔held / applied for / not held〕 |
| ISO/IEC 27018 | a code of practice for protecting personal information in the cloud | 〔held / applied for / not held〕 |
| Privacy Mark | a domestic scheme in which JIPDEC certifies conformity with JIS Q 15001 | 〔held / applied for / not held〕 |
| SOC 2 Type II report | a report in which an audit firm expresses an opinion on the operation of internal controls over a period. Not a certification | 〔held / not held〕 |
| ISMAP | the security assessment scheme for government information systems. Anyone can check registration on the public list at the ISMAP portal | not currently on the cloud service list |
For schemes not held, we say: “we do not currently hold this. We will update this page as the position changes.” Whatever the certification position, the specific controls we implement — encryption, access control, logging, vulnerability management, incident response, processor management — are described in the sections of this article, and we are happy to answer your security questionnaire or individual questions. If you need more to go on, contact tharada@the-unchain.com.
Our policy on publishing incidents
UNCHAIN, Inc. publishes, of its own accord, the cause and preventive measures for outages and security incidents affecting Pulse. What we have published is at Security reports.
Where an event amounting to a leak of personal data occurs, we report it to the Personal Information Protection Commission and notify the individuals concerned under Article 26 of the Act on the Protection of Personal Information. The procedure is described in Security and privacy FAQs.
Do not write that an incident was “published under the Basic Act on Cybersecurity”. Article 7 of that Act sets out a duty of effort for businesses and does not impose a publication obligation on private companies. What can be described as a legal obligation is reporting and notification under Article 26 of the Act on the Protection of Personal Information, and, where we have filed as a telecommunications carrier, reporting under Article 28 of the Telecommunications Business Act.
Reporting vulnerabilities
If you become aware of a vulnerability in Pulse, contact tharada@the-unchain.com. The scope of testing, the conditions you must observe, and the scope of the authorisation UNCHAIN, Inc. gives are set out in our Vulnerability disclosure policy.