Security at Arterect
Arterect builds AI, and security is one of the pillars of our business. Under the oversight of our Representative Director, the Arterect AI Security Team (AAST) works to make our AI systems and software more secure. This page sets out how that work is organised and who is accountable for it.
Arterect AI Security Team (AAST)
The Arterect AI Security Team (AAST) is Arterect Inc.'s dedicated team for AI security and cyber defence.
Under the oversight of Hayate Esaki, Representative Director, the team works on safety evaluation of AI systems, vulnerability analysis, application and cloud security, and research into defensive techniques.
Drawing on AI-assisted security analysis and testing methods, the team promotes secure software development and continuous security improvement.
- Official name
- Arterect AI Security Team
- Abbreviation
- AAST
- Security Oversight
- Hayate Esaki
- Title
- Representative Director
- Organization
- Arterect Inc.
- Security contact
- security@arterect.co.jp
Focus areas
- AI Security
- Defensive Cybersecurity
- Application Security
- Cloud Security
- Security Research
Organisation
Our Representative Director is accountable for security; AAST covers four functions.
Arterect Inc.
Arterect AI Security Team (AAST)
- Security Oversight / Representative DirectorHayate EsakiOversees information security; ultimately accountable
- Security GovernanceControls, access management and audit; security oversight at management level.
- AI Security ResearchResearch into the safety of AI systems and AI agents, and into defensive techniques.
- Security EngineeringVulnerability analysis, secure development and testing; protecting software and cloud.
- Security OperationsThreat analysis, monitoring and incident response.
How our security platform works
AAST works on a platform of five layers, each with a different job. The upper layers sit closest to the work people and AI do; the lower layers to recording and audit.
LAYER 01 — IDENTITY & ACCESS
Identity & access
- Organisational identity managementAn ID for each member, passkey authentication and device checks
- Zero-trust access controlBased on zero-trust principles: only authenticated people and devices
LAYER 02 — AI SECURITY WORKSPACE
AI-assisted security analysis
- AI-assisted security analysisAnalysing code and reviewing fixes
- Defensive researchResearch into defensive techniques using advanced AI
- Defensive AI agentsDefensive workflows that act only within approved limits
- Least-privilege integrationsConnected only to approved tools, with minimal permissions
LAYER 03 — ISOLATED EXECUTION
Isolated test environment
- Isolated security test environment
- Control of outbound traffic
- Separation of secrets
- Rules for running tools
Kept apart from our internal network and production, with access only to approved targets.
LAYER 04 — SECURITY ENGINEERING
- Source code analysisFinding problems while code is written
- Software vulnerability analysisKnown vulnerabilities in containers and dependencies
- Secret detectionKeeping keys and credentials out of code
- Cloud configuration checksPreventing exposure from misconfiguration
- AI safety evaluationTesting threats specific to AI systems
LAYER 05 — SECURITY OPERATIONS & AUDIT
- Security monitoring & loggingRecords of operations and traffic
- Anomaly detectionSpotting and flagging anything unusual
- Human approvalA person approves high-impact operations first
- Incident responseInvestigation, containment and reporting
What we commit to
The work AAST is responsible for, and the principles behind it.
- 01Protecting information
We protect the information entrusted to us and our own information assets from accidents, misuse and leaks.
- 02Secure development
We check security at each stage of design, implementation and review, so vulnerabilities are not built in.
- 03Vulnerability management
We receive vulnerability reports from inside and outside the company, assess their impact and track them through to a fix.
- 04AI safety evaluation
We test for and mitigate threats specific to AI applications, such as prompt injection and data leakage.
- 05Human approval
High-impact operations are reviewed and approved by a person before they run. The final decision never rests with AI.
- 06Incident response
When an incident occurs, investigation, containment, record-keeping, recovery and reporting are handled under the accountable officer.
We do not publish internal permissions, system architecture, the products we use or other details that could weaken our security.
Reporting a vulnerability
If you find a vulnerability in our website or services, please report it to the address below, in English or Japanese. What is in scope and how quickly we respond are set out on our Reporting a Vulnerability page.
Certifications
We have made the two-star declaration under IPA's SECURITY ACTION scheme, which is a self-declaration. We do not currently hold third-party certifications such as ISO/IEC 27001 or SOC 2.
SECURITY ACTION (IPA, in Japanese)The official site of SECURITY ACTION, IPA's scheme in which small and medium-sized businesses declare their own commitment to information security.ipa.go.jp/security/security-action
This English text is provided for convenience. The Japanese version is the authoritative text; if the two differ, the Japanese version prevails.