Our Approach to Information Security

Information Security Policy

Yamashou Technology Co., Ltd. (“we” or “the Company”) protects the information assets of the Company and its customers in accordance with the following principles.

1. Management responsibilityUnder the leadership of management, we address information security in an organized and continuous manner.
2. Compliance with laws and contractsWe comply with laws, regulations, and standards related to information security, as well as our contractual obligations to customers.
3. Internal organizationWe maintain an organizational structure for sustaining and improving information security, and establish the necessary controls as formal internal rules.
4. Protection of information assetsWe implement appropriate organizational, technical, and physical controls to protect the information assets of the Company and its customers from leakage, tampering, destruction, unauthorized access, and other threats.
5. Employee educationWe provide ongoing information security education to all employees to ensure this policy is understood and put into practice.
6. Incident responseIn the event of an information security incident, or a risk of one, we respond promptly to contain the impact and prevent recurrence.
7. Continuous improvementWe regularly review and continuously improve our information security practices.

Established: September 3, 2026
Keiichi Noguchi, Representative Director, Yamashou Technology Co., Ltd.

Controlled Public Disclosure

Because we design, operate, and maintain IT environments on behalf of our customers, we deliberately do not publish information on our website or elsewhere that could assist reconnaissance or targeted attacks.

As a rule, we do not publicly disclose:

• customer names or case studies;
• network architecture, system configurations, or administrative access paths;
• the products, software, services, and versions we use; or
• details of our operational structure, monitoring methods, or personnel.

This is a deliberate security practice intended to protect our customers’ environments, not a limitation of our technical operations. Detailed information is provided directly to parties who require it, under contract and confidentiality obligations.

Defensive Security

We identify, remediate, and continuously improve the security of systems that we own, develop, or operate, and of customer environments for which we have explicit authorization.

• Scope and authorization are documented in advance. We do not conduct assessments outside the agreed scope.
• Vulnerability validation is performed in isolated test environments wherever practicable. Where validation in a production environment is necessary, it is conducted only within a predefined and authorized scope, with measures to minimize operational impact.
• The process from discovery to remediation is recorded, and fixes are reviewed by a responsible engineer before being applied.
• The same scope and procedures apply when analysis tools, including AI-based tools, are used.

Governance

In work involving customer information and systems, we apply the following baseline controls:

• individual user authentication and multi-factor authentication;
• access control based on the principle of least privilege;
• logging and auditing of access and operational activity;
• human review and approval of significant changes; and
• need-to-know handling of information, with appropriate retention and disposal.

Responsible Disclosure

If you discover a vulnerability in a service or system provided by the Company, please contact us using the details below. Reports are used solely for the purpose of improving security.

What we ask of reporters

• Please describe the affected target, steps to reproduce, and the expected impact.
• Please refrain from viewing, retrieving, modifying, or deleting data, and from any activity that could disrupt service availability.
• Please do not publicly disclose the issue until we have completed our response.

What you can expect from us

• We will review the report and a responsible engineer will contact you.
• We do not intend to pursue legal action against good-faith research conducted in accordance with this page.
• For vulnerabilities in third-party products, we cooperate in responsible disclosure to the relevant vendor or maintainer.

This page does not authorize access to our customers’ environments or any testing beyond the scope described above.