Security Policy

Organizational Security Management Measures

We have appointed a person responsible for the handling of personal information, clarified the scope of employees who handle personal information and the personal information they manage, and established a reporting and communication system to the responsible person in the event that any facts or signs of violations of the Personal Information Protection Act or internal regulations are identified.

1. Establishment of Organizational Structure
   To manage personal information securely, we have appointed a Chief Privacy Officer (CPO), an audit manager, and other operational managers to clarify responsibilities and roles.

2. Development and Operation of Compliance Programs (Personal Information Protection Regulations)
   We have established a compliance program as a code of conduct for personal information protection (including provisions based on the determination that Japan ensures an adequate level of protection for personal information in accordance with GDPR). We conduct regular education and training for all personnel engaged in uSonar's business to ensure thorough awareness and continuous improvement.

3. Means to View the Status of Entrusted Data Handling
   We have built a system that lists the handling status of entrusted data by utilizing an entrusted media management ledger. Furthermore, when receiving data, we issue a "Customer Information Receipt and Return Form," store the data on servers with access restrictions, and manage physical media under lock and key.

4. Evaluation, Review, and Improvement (Establishment and Operation of the Security Center)
   We assign responsible persons and staff members to handle personal information and execute evaluations, reviews, and improvements as needed through our Security Center (Management Committee Chairperson: Representative Director Nami Fukutomi).

5. Handling of Incidents or Violations
   In the unlikely event that an incident or violation is discovered, we have established a workflow at our Security Center to conduct fact-finding investigations, determine root causes, identify the scope of impact, plan and implement recurrence prevention measures, and take appropriate actions.

Human Security Management Measures

We conduct regular training for employees regarding points to note when handling personal information and include provisions concerning the confidentiality of personal information in our employment regulations. We implement human security management measures by requiring employees to sign non-disclosure agreements for personal information designated as business secrets and by providing ongoing education and training.

1. Execution of Pledges with Employees at the Time of Hiring
   All employees, temporary staff, and part-time workers at uSonar are required to sign a confidentiality pledge. Furthermore, we require family members to act as joint guarantors.
2. Execution of Contracts with External Vendors for Outsourced Operations
   When outsourcing the handling of personal information to companies such as direct mail distributors or data entry firms, we select providers that maintain a certain level of information security and personal information protection systems. As part of our selection process, we have established internal standards for selecting contractors, maintain investigation records, and clarify the responsibilities (and criteria for exemption) of the contractor through business outsourcing agreements, which include provisions for confidentiality, sub-contracting, division of responsibility in the event of an incident, and the return or deletion of personal information upon contract termination.
3. Implementation of Internal Regulations, Education, and Training for Employees
   uSonar conducts personal information protection training for all new hires, mid-career employees, part-time staff, and advisors as part of our onboarding and orientation programs. For all uSonar employees, we provide updates at least once a year regarding our internal compliance program, the contents and improvements of our personal information protection training manual, and any ad-hoc reports on legal amendments to ensure full awareness.
4. Analysis of Employee Psychological State
   We utilize text mining to extract psychological states from the daily reports submitted by employees, analyzing their levels of negativity and positivity.
5. Special Management of Temporary Staff
   Because temporary staff have different employers, we set their security access privileges lower than those of regular employees, ensuring they cannot physically or technically access personal information.
6. Fair Evaluation and Self-Reporting System
   We strive to maintain employee motivation by ensuring fair evaluations and utilizing systems such as self-reporting.
7. Inability to Manipulate Customer Information Individually
   We have established a system that prevents any single operator from extracting highly confidential personal information, requiring at least two individuals to perform such operations.

Physical Security Management Measures

We implement physical security management measures, such as managing entry and exit to offices and rooms and preventing the theft of personal information, to prevent unauthorized access to information, as well as the loss, destruction, falsification, and leakage of information.

1. Entry and Exit Management
   We have implemented an entry and exit management system for all doors that utilizes employee ID cards to manage access history and restrict entry and exit.

2. Prevention of Theft and Other Incidents

   • Surveillance Cameras
   We monitor for unauthorized intruders and illicit activities 24 hours a day, 365 days a year using surveillance cameras. Image data recorded by these cameras is stored for at least three months to maintain access history.

   • Locked Storage for Electronic Media
   In addition to physical locking mechanisms, access to areas containing storage cabinets is restricted via our entry and exit management system.

   • Nighttime and Holiday Support
   We provide 24/7, 365-day security through a combination of building security personnel and monitoring equipment, including surveillance cameras and entry/exit management systems.

   • Prohibition of Removing Equipment from the Office
   Removing equipment such as PCs from the office is prohibited. As an exception, removal is permitted only after following the application and approval procedures designated by the CIO.

   • Implementation of Personal Belongings Inspections
   We conduct random inspections of personal belongings to regularly check that unauthorized personal PCs, storage media, smartphones, blades, or dangerous items are not brought into the office.

Technical Security Management Measures

We have implemented mechanisms to protect information systems that handle personal data from unauthorized external access or malicious software.

1. Identification and Authentication for Data Access
   We maintain real-time logs for all terminals, recording who accessed what, when, and how every operation was performed.

2. Access Control

   • Login Control
   uSonar grants access to personal data only to authorized personnel. Data is not duplicated, and access logs are maintained and monitored. Furthermore, at uSonar, each individual sets their own password for logging into their terminal. Electronic documentation is managed on a shared server, with access control implemented at the folder level within the system.

   • ID Management and Deletion
   We immediately modify or revoke access rights, including IDs and building access cards, for employees who have transferred or resigned.

3. Software Security Measures

   Malware Protection
   To address both known and unknown malware, we have installed multiple security software solutions on all terminals.

   Blacklisting
   Each user is granted only standard user privileges on their terminal and cannot install applications. We maintain a blacklist of unauthorized software and have implemented controls to prevent such software from launching, even if it were to be installed.

4. Measures for Data Transfer and Transmission
   Confidential information transmitted via the uSonar network or the internet is encrypted using TLS and is only sent after receiving approval from a designated administrator. Additionally, when files are sent via email attachments, an automatic BCC function notifies supervisors. Designated personnel also conduct periodic reviews to ensure that all transmissions were appropriate.
5. Desktop Virtualization (VDI)
   By utilizing VDI, we ensure that no data remains on the client terminals (including laptops) used by individuals. Consequently, there is no need for specific measures against data exfiltration via USB, Bluetooth, or other external media.
6. Implementation of Third-Party Security Audits
   We conduct regular security inspections (information leakage checks). As a result, we have received evaluations confirming that the security framework of uSonar is robust.

For security reasons, other measures are not disclosed. Please contact us for further details. We will provide explanations as necessary.

Formulation of Personal Information Protection Policies and Establishment of Rules Regarding the Handling of Personal Information

• • To ensure the appropriate handling of personal information, we have established regulations regarding compliance with relevant laws, guidelines, and other standards, as well as points of contact for inquiries and complaints. For the stages of acquisition, use, storage,
• • Provision, deletion, and disposal, we have established regulations concerning handling methods, responsible personnel, and their respective duties.

ISO Certification

uSonar has obtained three ISO certifications.

1. Information Security Management System - ISO/IEC 27001:2013
   Certification Registration Number: IS 696370 Certification Date: 2018/09/25
2. ISMS Cloud Security - ISO/IEC 27017:2015
   Certification Registration Number: CLOUD 731975 Certification Date: 2020/11/04
3. Management System for Protection of PII in Public Clouds Acting as PII Processors - ISO/IEC 27018:2019
   Certification Registration Number: PII 731976 Certification Date: 2020/11/04

December 15, 2021: Partially Revised
July 19, 2022: Company name changed from Landscape Co., Ltd. to uSonar Co., Ltd.