Purpose of information security

Our company deeply recognizes that protecting our information assets from foreseeable serious threats, implementing necessary information security measures, and ensuring the continuity and stability of our business activities are important social responsibilities. To achieve this, we have established the following basic policy regarding information security.

Definition of Information Security

At our company, "information security" refers to protecting information assets from threats and ensuring and maintaining the confidentiality, integrity, and availability of those information assets.

Confidentiality: Ensuring that only authorized individuals can access information assets.

Integrity: Maintaining the accuracy and completeness of information assets and their processing methods.

Availability: Ensuring that necessary information assets can be accessed when needed.

Information security goals

Our company has set the following objectives regarding information security:

1. Ensure the confidentiality of information assets and prevent their leakage.
2. Ensure the integrity of information assets and prevent their tampering.
3. Ensure the availability of information assets and keep necessary information assets accessible when needed.
4. In the event of an information security incident, rapid recovery and implementation of measures to prevent recurrence will be necessary to minimize damage.

Scope of application

Based on this policy, our company manages all of its information assets.

Furthermore, our officers and employees shall understand and comply with this policy and related regulations, and when outsourcing our business operations, we shall enter into contracts or other agreements that stipulate that the outsourcing partner shall perform the operations in accordance with this policy.

Information security system

Our company has established an "Information Security Officer" to be responsible for information security, and has also established an "Information Security Committee" to implement information security measures.

Conducting a risk assessment regarding information security.

Our company will establish and maintain an information security management system in line with the organization's strategic risk management.

Furthermore, we conduct risk assessments regarding the confidentiality, integrity, and availability of information assets, threats to information assets, and vulnerabilities in information security, and implement appropriate risk reduction measures for high-risk situations.

Compliance with laws and regulations concerning information security

Our officers and employees must comply with laws and guidelines related to information security, including copyright law, the Act on Prohibition of Unauthorized Computer Access, and the Personal Information Protection Act.

Education on information security

Our company will ensure that this policy is thoroughly communicated to our officers, employees, and business partners, and will continuously provide the necessary training to maintain information security.

Ensuring business continuity

In the event of business interruptions due to disasters, equipment failures, etc., our company will take necessary measures to minimize damage and ensure business continuity.

Continuous improvement of information security

Our company conducts internal audits periodically or as needed to ensure that information security is maintained.

Furthermore, we will conduct timely reviews to respond to environmental changes such as changes in information systems and new information security threats, and continuously improve information security.

Disciplinary action for violations, etc.

Any officer or employee who violates this policy or related regulations will be subject to disciplinary action in accordance with the Company's regulations.

Implementation of information security measures related to the provision of cloud services

To protect customer information in the cloud services we provide, we will implement the following measures.

• Compliance with various information security guidelines regarding the design and implementation of cloud services.
• Technical measures such as access control and environment isolation to prevent unauthorized access by internal personnel and other customers.
• Prompt notification of cloud service changes that may affect customers.
• Technical measures to maintain information security in virtual environments, such as fortifying virtual machines.
• Appropriate information sharing with customers in the event of an information security incident.

Implementation of information security measures related to the use of cloud services

To protect the information handled in the cloud services we use, we will implement the following measures.

• Verification of the implementation status of information security measures by cloud service vendors.
• Confirmation of the appropriateness of the terms of service, including whether the cloud service vendor has access to the information, the country where the information is stored, and the relevant laws and regulations of that country.
• Technical measures such as access control and log monitoring to prevent fraudulent activity by users of our cloud services.

　

Established: June 1, 2026
G-Gravity Inc.
Representative Director and CEO: Tomohiro Yamagata