An information security policy
We have an Information Security Policy. Under the responsibility of management, we keep working as an organization to improve information security.
Security
We protect your information through both our organization and our technology.
Connexy holds information you entrust to us, including your profile, messages, and event participation. We treat protecting that information as work that is never finished, and we keep adding safeguards and reviewing them.
ISO/IEC 27001 (ISMS) certification
We are certified to ISO/IEC 27001, the international standard for an information security management system (ISMS).
- Certificate number:
- JP25/00000279
- Certification body:
- SGS Japan Inc.
- ISO/IEC 27001 certification from an independent body
- Data stored in Japan (Tokyo Region)
- TLS 1.2 or higher in transit, and encryption at rest
- Login protected with two-factor authentication and passkeys
- Your information is not used to train AI
Organization
Organizational measures
We set a policy and, under the responsibility of management, keep improving information security as an organization.
Training for employees
We work so that employees learn what they need to know about information security and handle information appropriately.
Access limited to the people who need it
Only staff who need it for their work can use the production environment and administrative functions. Staff look at the contents of messages and similar information only in the cases set out in the Privacy Policy, such as when you have agreed so that we can respond to an inquiry, when we are responding to misuse, or when the law requires it.
Preparing for an incident
If an incident such as a personal information breach occurs, we work to limit the damage and investigate the cause. Where the law requires it, we also report to the Personal Information Protection Commission and notify the people affected.
Technology
Technical measures
From storage and communications to access rights, development, and monitoring, we have safeguards at each stage.
Protecting data
Stored in the Tokyo Region
Databases and uploaded files are stored on Amazon Web Services (AWS) in the Tokyo Region. AWS is responsible for physical security at the data centers.
Encryption in transit and at rest
Connections with Connexy are encrypted with TLS 1.2 or higher. Data stored in the database is encrypted as well. Information we treat with extra care, such as conversations with the AI assistant, is encrypted individually on top of that.
Protection from external attacks
The database sits where it cannot be reached directly from the internet, and a web application firewall (WAF) blocks common attacks.
Backup and recovery
We back up data every day and also keep those backups in another region in Japan. We have recovery procedures ready for a large-scale failure.
Checking access rights
Checked on the server for every view and action
Every time information is shown or an action is taken, the server checks whether that person is allowed to view it or take the action. During development we also check this with automated safeguards, so a missed check does not slip through.
Images and files follow the same audience
Images and attached files are also checked against the audience settings every time they are shown. Images and files you can no longer view, such as after you leave a group message, are not shown.
Development and vulnerabilities
Automated checks before release
Changes to the service are released only after they pass automated tests and automated checks that include security.
Regular review of the whole source code
We regularly inspect the whole source code with AI-assisted vulnerability assessment services, including Devin Security Swarm.
Managing software components
Every day we automatically check the software components we use for known vulnerabilities, and we respond within a deadline based on severity. As a defense against attacks through those components (supply-chain attacks), we wait a set period before adopting a newly published component, and we pin the versions we use.
Keeping personal information out of logs
In error records and logs, passwords, email addresses, and similar data are masked automatically.
Monitoring and payment information
Detecting unauthorized access and unusual activity
We watch for unauthorized access and unusual behavior with cloud threat detection and with logs. Important events are sent to the responsible staff right away.
We do not hold card numbers
Credit card numbers are received and processed directly by the payment service (currently Stripe). Our servers do not receive card numbers, and they do not store them.
Account
Features that protect your account
To protect your account from unauthorized login, we provide the following features.
Two-factor authentication and passkeys
You can sign in with two-factor authentication (an authenticator app, or a verification code by email) and with a passkey.
Login notifications
When there is a sign-in, we email you. A sign-in from an unfamiliar environment may ask you to confirm by email.
Another check before important actions
Before an important action, such as changing your password, we verify that it is you again.
A limit on login attempts
To reduce unauthorized login attempts, we limit how many times a login can be tried in a row.
Sign out of every device at once
You can sign out of every device at once.
Passwords stored safely
Passwords are stored in a form that cannot be turned back into the original. Passwords known from past breaches cannot be set.
Login information protected in the apps
On the iOS and Android apps, login information is encrypted and stored in the device's secure storage.
AI
AI features and your data
Using AI does not widen what you can see. AI features also include safeguards for your information.
Limited to what you can already see
When AI uses information inside Connexy, it is limited to what the person using AI is allowed to view. Using AI does not expand that range.
Actions stay within your own permissions
When AI takes an action on your behalf, it does so only within that person's own permissions.
Not used to train AI
We contract and configure the providers that handle AI processing so that information we send is not used to train their models or improve their services. We also do not currently use your information to train AI.
Defenses against prompt injection
We keep adding defenses against attacks that hide malicious instructions in what is sent to the AI (prompt injection).
Report
Reporting a security issue
If you notice a security issue in Connexy, please contact us through the contact form. We will review the report and take the steps that are needed.
While you are checking an issue, please do not access other people's information or take actions that interfere with running the service.