Information Security Policy
Protecting the information entrusted to us, and the trust that comes with it
How we approach information security
Arterect Inc. works as a whole company on information security, in order to protect the information assets entrusted to us from accident, disaster and crime, and to be worthy of the trust placed in us by our customers and by society.
SECURITY ACTION — two stars
We have made the two-star declaration under IPA's SECURITY ACTION scheme.
Management responsibility
Management leads the organised and continuous improvement of information security.
Internal structure
We maintain an organisation responsible for maintaining and improving information security, and set our security measures down as formal internal rules.
What we expect of our people
Our people acquire the knowledge and skills that information security requires, and make our security work real in practice.
Legal and contractual compliance
We comply with the laws, regulations, standards and contractual obligations that apply to information security, and work to meet our customers' expectations.
Responding to breaches and incidents
Where a breach of law or contract, or a security incident, occurs, we respond appropriately and work to prevent it happening again.
Reporting a vulnerability
We welcome reports of vulnerabilities in our website and services. Machine-readable details, including where to report and how long this policy is valid, are published in our security.txt in line with RFC 9116.
Please send reports to security@arterect.co.jp, in Japanese or English. Steps to reproduce, the scope of impact, and screenshots where useful will help us investigate quickly.
security@arterect.co.jpsecurity.txt (RFC 9116)
- Authentication and authorisation flaws (bypassing access control, privilege escalation)
- Execution-class vulnerabilities such as arbitrary code execution, cross-site scripting (XSS) and SQL injection
- Exposure of personal data, credentials or non-public information
- Vulnerabilities arising from server or network misconfiguration
- Scanner output alone, with no steps to reproduce
- Denial of service, load testing, or any test involving a large volume of requests
- Social engineering, physical intrusion, or any approach involving contact with our staff
- Vulnerabilities in third-party services we use (please report those to the provider)
- Deviations from best practice with no explanation of actual impact
- Keep testing to the minimum necessary, and do not obtain, alter or delete anyone else's data.
- If you reach personal data, stop immediately and report it without retaining what you obtained.
- Please do not disclose the vulnerability to anyone else until it has been fixed.
- We will send a first reply within three business days of receiving your report.
- We will keep you updated on the investigation and on when we expect to have a fix.
- After the fix, we will credit you if you would like us to. We do not currently run a paid bug bounty.
We will not take legal action against anyone who investigates and reports in good faith in line with this policy.
This English text is provided for convenience. The Japanese version is the authoritative text; if the two differ, the Japanese version prevails.