Security
Security
As a platform entrusted with our customers' words, we publish how and where data is stored, how it is encrypted, and who can touch it.
Data Handling
How we handle data
Data stored in Japan
All conversation and customer data is stored in data centers located in Japan and is never transferred offshore — an arrangement financial institutions and public-sector clients can adopt as-is.
Encryption in transit
Traffic between browsers, the telephone network, and integration partners is encrypted with TLS 1.2 or higher. Administrative access is HTTPS-only.
Least-privilege access
Only staff whose work requires it can access customer data. Administrative operations require two-factor authentication, and permissions are reviewed quarterly.
Audited access logs
Logins, data views, exports, and configuration changes are logged and audited on a regular cycle. Logs are stored in tamper-evident form.
Managed retention
Retention periods for conversation data are configurable per plan, with automatic deletion at expiry. When a contract ends, all data is erased by the agreed date.
No data subprocessors
We do not subcontract work that touches conversation data. Parts of our infrastructure run on domestic cloud providers, with storage restricted to regions within Japan.
Operations
Operational policies
Vulnerability response
We continuously track vulnerability information for our software dependencies and set patch deadlines by severity. For critical vulnerabilities, our target is to begin the response within 24 hours.
Backups
Conversation data is backed up daily and stored at a separate domestic site. Recovery procedures are rehearsed twice a year.
Incidents and contact
If a service-affecting incident occurs, we email an initial notice to the administrators of affected contracts, followed by a post-incident report covering cause and prevention. To report a security concern, please use the contact form or email support@kotoyui.cc. A responsible engineer reviews every report within 24 hours.
Employee training
All employees complete information-security and privacy training at onboarding and annually thereafter. Handling of customer data is strictly defined in work rules, with disciplinary consequences for violations.
Last updated: April 1, 2026
Have security requirements?
We answer procurement security checklists and review individual requirements as part of onboarding.