Design documents, customer data and operational knowledge deserve controls that match their sensitivity and purpose.
Across our development operations in Japan and Vietnam, we define where information is held, who can access it and how it is used. This page explains our safeguards and the arrangements established for each client project.
We also respond to your security questionnaires and discuss requirements specific to your organization or your customers.
Technica AI Inc. and the group companies covered by this policy (hereinafter “we”) consider the information entrusted to us by our clients to be among our most important assets. We establish this policy to prevent information security incidents (hereinafter “incidents”) and to minimize their impact should they occur.
In this policy, information security means maintaining the confidentiality, integrity and availability of information assets.
This policy applies to the following sites and operations.
The Representative Director and CEO bears ultimate responsibility for this policy. Officers and employees are responsible for complying with this policy and related rules, and for reporting incidents and weaknesses.
Our Representative Director and CEO has ultimate responsibility for information security. The Information Security Manager oversees day-to-day implementation, supported by designated personnel at our Japan and Vietnam operations.
| Role | Main duties |
|---|---|
| Chief Information Security Officer (Representative Director and CEO) | Establishing security policy and directing responses to serious incidents |
| Information Security Manager | Maintaining security rules and coordinating training |
| Site leads (Tokyo, Hanoi) | Day-to-day operations, entry and exit control, device management |
| Incident contact point | Receiving incident reports, coordinating initial response, and communicating with clients |
Technica Co., Ltd. (Vietnam) is working toward ISO/IEC 27001 certification. It has not yet been certified.
Target: by the end of 2027
Technica AI Inc. (Japan) plans to pursue PrivacyMark certification. It has not yet obtained the PrivacyMark.
Target: by the end of 2027
Once certification is obtained, we will publish the relevant registration information and certified scope on this page.
Technica AI complies with the laws, regulations and guidelines that apply to its business and its handling of personal data, including Japan’s Act on the Protection of Personal Information (APPI) and Vietnam’s Law on Personal Data Protection.
Information security depends on clear responsibilities and consistent practices. We apply the following requirements for confidentiality, training, access changes, and incident reporting.
All officers and employees sign nondisclosure agreements when they join. Confidentiality obligations continue after employment ends:
• General confidential information: for five years after leaving
• Trade secrets, source code, algorithms, technical know-how and other information that by its nature requires ongoing protection: until the information is no longer confidential
In addition to training when they join, all officers and employees receive regular information security training.
When an employee changes roles or leaves, access rights that are no longer required are removed. Departing employees return company-issued devices and authentication devices, while transferred employees receive permissions appropriate to their new responsibilities.
All officers and employees must promptly report to the designated contact point any incident or suspected incident, vulnerability or other anomaly they become aware of. Reported cases are handled according to the established incident response procedure.
As a rule, we do not subcontract work outside our group. When our Vietnam entity, Technica Co., Ltd., takes part in a project, we agree on this with you in advance, including how it is treated under the contract.
Development takes place at our sites in Japan and Vietnam. The physical controls at each site are described below.
Our Japan site (Kanda, Tokyo) is secured with card keys and locks.
Our Vietnam site (Hanoi) uses individual biometric authentication, and entry and exit records are retained.
For dedicated offshore development center (ODC) engagements, we can arrange development rooms separated from other projects, subject to the agreed requirements. Access is restricted to authorized project personnel.
The use of USB flash drives and other external storage media is prohibited.
Security cameras are installed at our Vietnam site.
Our Japan entity has its own development team. Depending on project requirements, development can be organized entirely within Japan. We can also arrange on-site work at your premises or your customers’ sites.
| Area | Measures |
|---|---|
| Hosting | Japan-region cloud configurations available on request |
| Network | External connections are permitted only via VPN |
| Authentication | Multi-factor authentication and single sign-on through Google Workspace are required |
| Devices | Only company-issued devices are used; personal devices may not be used for work |
| Backup | Daily backups, defined restoration procedures, and regular restoration testing |
Details of our technical measures can be provided during a project security review.
We collect and access only the information necessary for the agreed project. Where feasible, we first consider solutions that avoid requiring the client to provide personal information.
Client-provided data and development work products are stored in approved environments, including those listed below. Storage locations, cloud regions, and permitted access are determined for each project. Storage on personal devices or unapproved external services is prohibited.
• In-house servers (located in our office in Hanoi, Vietnam)
• Approved cloud storage (Amazon S3, in the region agreed for the project)
Jira and Confluence, which we use for project management and document sharing, are self-hosted on the in-house servers above rather than used as external SaaS.
Where Japan-only data residency is required, we can configure storage in Japan regions. Data residency and the locations from which personnel may access data are agreed separately.
Communications between client devices and servers are protected using TLS (Transport Layer Security).
Production data is generally not used in development environments; masked or anonymized data is used where appropriate. Masked data is still treated as personal data if individuals remain identifiable.
Retention periods for client data are set for each project. After the contract ends or the purpose of use has been achieved, we return the data or delete it securely in accordance with the contract and our agreement with you, except where retention is required by law or regulation. Backup copies are deleted according to the applicable retention and backup schedules. As needed, we report to you when deletion is complete.
Our development teams operate in Japan and Vietnam. Because the two entities are separate legal persons, transfers of personal data from our Japan entity to our Vietnam entity may be subject to Article 28 of Japan’s Act on the Protection of Personal Information (APPI), depending on the arrangement. We assess applicable requirements before data is shared.
We discuss the following data-handling approaches with clients and define the applicable controls in the project agreement.
Where practical, we use anonymized, synthetic, or appropriately masked data to reduce the need to transfer personal data. Masking alone does not necessarily remove information from the scope of privacy law; the status of the data is assessed before transfer.
Where required, processes involving personal data can be performed by our Japan-based team, with access limited according to the agreed project arrangement.
Where cross-border handling is needed, we put appropriate contractual and operational safeguards in place and assess the applicable legal requirements. Where the APPI requires equivalent protection measures, we establish and monitor the necessary arrangements.
Before processing begins, we agree on the handling locations, authorized personnel, access permissions, and relevant contractual safeguards. Third-party AI services, if approved, are governed by separate service and data-processing conditions described below.
This section concerns client project data handled by our development operations. Website inquiries and analytics services are addressed separately in our Privacy Policy.
We separate project environments, access permissions, and source code to reduce the risk of unauthorized access or unintended sharing between projects.
Development changes are reviewed before production deployment, and access is managed by project. Our controls for using generative AI during development are described under AI Security.
Development, staging and production environments are separated, and permissions are managed separately for each.
Every change deployed to production is reviewed by another team member.
API keys and passwords must not be committed to source code.
We perform vulnerability scanning on software dependencies used in our projects.
Access in version control is separated by project.
Delivery follows the method set out in the contract, and we also agree on how any copies we keep after delivery are handled.
AI introduces specific risks involving external model providers, confidential inputs, generated outputs, and activity logs. We distinguish between AI used in our development process and AI delivered as part of a client solution. In both cases, the permitted processing environment and data-handling conditions are agreed with the client.
Two deployment approaches are available: approved external AI services and self-hosted models. The appropriate approach depends on project requirements, information sensitivity, and the locations where processing is permitted.
We use AI within our software development processes under the tool, data-access, and security conditions agreed for each client engagement.
We use licensed enterprise AI services only where the project permits external processing. The approved tools, service terms, and handling of client data are reviewed against the project’s security requirements.
We run open-weight AI models in an agreed self-hosted environment without sending prompts or client data to external AI model providers. This can support projects that prohibit external AI services. The hosting location, network access, logging, and retention arrangements still need to be defined for each project; a Technica AI-managed environment is not automatically the same as the client’s own environment.
Self-hosted execution can keep model processing within an agreed controlled environment, without sending inputs to an external AI provider.
For product deployments, the AI architecture is selected with the client during solution design, taking into account data residency, access control, performance, and security requirements.
The product connects to an approved external LLM service. This approach can provide access to a wider range of hosted model capabilities, subject to agreed data-processing terms, performance requirements, and security controls.
If you choose this configuration, the same criteria as in “Use of generative AI in development” above apply to the scope of services used and to confirming that the contract terms exclude use for training.
The model runs on-premises or in an agreed dedicated environment. Model requests and responses are processed within that environment and are not sent to external AI providers as part of inference. Data storage, administration, and logging remain subject to the deployment configuration.
Making internal knowledge searchable across sources creates a risk that answers will include information a user is not supposed to access. AIKNOW applies permission checks during retrieval, generation, and tool execution to help prevent users from accessing information beyond their authorized scope.
The questions users enter and the answers returned contain confidential information. Depending on the approved deployment configuration, logs may be stored in an LLM/RAG observability platform or on server or container storage. Access is restricted through role-based access control (RBAC); the location and handling of logs are part of the project’s security design.
Our incident response procedures cover detection, containment, notification, impact assessment, recovery, and prevention of recurrence. Clear responsibilities and escalation paths support timely action when an incident occurs.
If an incident involving your information is confirmed, we notify you promptly and provide updates as our investigation progresses.
Designated response personnel at our Vietnam site can support incident handling when the Japan team is unavailable.
For service availability, support hours and initial response targets by severity level, see our Service Level Objectives.
We can discuss deployment restrictions, data handling, access controls, and development arrangements—including on-premises environments and Japan-based teams. Our team also responds to security questionnaires during vendor assessments.
