Your information, protected by design.
An information security structure certified to ISO/IEC 27001:2022. Backed not just by policy, but by day-to-day practice on the development floor and independent third-party assessment.
Our Approach to Information Security
Information security means protecting your data through a system built on three pillars: policy, operations, and third-party assessment. Miichisoft is certified to ISO/IEC 27001:2022.
With the concerns of IT and procurement teams in mind, we lay out our certification evidence, how we handle data, the security measures built into our development practice, and what to check before you engage us.
Data Handling and Security Principles
- A three-tier information classification (public / internal / confidential), with access controls matched to each tier
- Access rights follow the principle of least privilege, with scope limited by role and enforced through network segmentation and IP restrictions
- Data encryption (at rest) and communication protection (SSL/TLS, i.e. encrypted data in transit) to prevent information leaks
- Secure configuration and input validation, disabling unnecessary features and validating input to reject malicious data
- Controlled use of tools and libraries, with development and operations limited to approved configurations only
- Biometric access control for facility entry, possession-based authentication via IC cards and tokens, and regular BCP/DR (business continuity and disaster recovery) testing
Certifications & Assessments (Evidence)
Backed by certification and third-party assessment, not policy statements alone.
ISO/IEC 27001:2022
Certified for information security management (certificate available).
ISO 9001:2015
Certified for quality management.
Third-Party Assessment & Internal Audit
Assessed by certification bodies, with internal audits conducted every quarter.
Information security is operated as one system together with our quality assurance framework. Quality & Japanese Language Support →
Secure Development and Auditing
Beyond certification and policy, we maintain mechanisms that embed security into development on a daily basis.
Secure Coding
Implementation follows our coding standards and undergoes code review, keeping vulnerabilities out of the codebase from the start.
Static Analysis & Vulnerability Scanning
SonarQube and OWASP ZAP (tools for automated static code analysis and vulnerability scanning) detect quality and security risks before release.
Process Audit (PQA)
Our PQA (Process Quality Assurance) team periodically checks compliance with the development process.
Information Security Training
All employees take an information security assessment to confirm that practices are being followed.
These practices are standardized and operated as a Secure SDLC, embedding security requirements into every phase from planning through maintenance.
How we handle confidential data in AI-assisted development is governed by a dedicated policy.
View our AI Data Governance policyFrequently Asked Questions (For Procurement Teams)
Where is data stored?
We use AWS (Tokyo Region), so data is stored within Japan. Alternative arrangements can be discussed to meet your requirements.
How is cross-border data transfer (to Vietnam) handled?
Our subcontractor (Miichisoft, JSC) complies with Vietnam's personal data protection framework (Decree 13/2023/ND-CP and the Cybersecurity Law). This includes limiting use to the stated purpose, returning or disposing of data upon completion, maintaining access logs, and reporting incidents.
How is confidential data protected in AI-assisted development?
As a baseline, AI tools are run in a sandbox (an isolated execution environment) to prevent confidential data from leaking externally. Depending on your requirements, we can also offer a locally hosted large language model (Local LLM) running within your own environment, or a configuration that does not depend on any single AI service. Details on data handling are covered in our AI Data Governance policy.
Is subcontracting possible?
Only with prior written consent, and under a contract with security clauses equal to or stronger than our own.
What happens if an incident occurs?
We maintain a defined contact structure and response procedure, and report to the client promptly. For vulnerability response, we run IDS monitoring and regularly review OS/patch management and configuration inventories.
What happens to data when the contract ends?
Data is either returned or irrecoverably destroyed, with written confirmation of completion. Ownership of intellectual property in deliverables is defined clearly in the contract.
Can you align with our company's security policy?
Yes. We can accommodate your policies with measures such as a dedicated development environment, client-supplied PCs, or a designated security room. All employees take a quarterly information security assessment.
Feel free to reach out with any security requirements.
We have a security questionnaire response document ready for procurement teams. Tell us about your requirements and we will respond individually.
* Certificate numbers and scope of coverage are available on request for procurement purposes.
* Data handling and on-the-ground development safeguards reflect our standard operating practices (self-reported).
* The contracting entity is our Japanese corporation, Miichisoft Japan Co., Ltd. A Japanese-language point of contact is available.