Our Security Initiatives

What we do today

Confidentiality

• Communications are encrypted with HTTPS.
• Sign-in uses Amazon Cognito, and tokens are revoked on sign-out.
• Data for paid features is served only after the server verifies the plan entitlement.
• Secrets such as database credentials are kept in a dedicated secrets-management service, not embedded in code.
• Multi-factor authentication is enabled on operator administrator accounts.
• AI chat passes through input and output safety checks and filters designed to prevent leakage of personal or internal information.

Integrity

• The production database is accessed with read-only permissions.
• Administrative operations and configuration changes are recorded, and suspicious changes are notified to operators.
• Saved AI chat records carry an integrity signature so that alteration can be detected. If a signature cannot be applied, the record is not saved.

Availability

• Core servers run 24 hours a day.
• Operating status is monitored continuously, and operators are notified when an anomaly is detected.
• Some data stores have point-in-time recovery enabled.
• Excessive access is limited by rate limiting.

Resilience against attacks

• A web application firewall (WAF) is in place.
• Suspicious sign-in activity is recorded and audited.
• When a vulnerability is reported, we assess its impact and respond in order.

Record retention

• System operation logs are retained for up to 10 years and used only to investigate incidents and unauthorised access and to respond to audits. See our Privacy Policy for details.

Track record of assessments and regular checks

MAPRISE does not treat security as a one-off exercise. We assess, fix and repeat.

Regular checks

• Daily: we detect unintended changes to the production configuration, and record and review suspicious sign-in activity.
• Weekly: we scan the software components we use for known vulnerabilities and review findings about configuration and code.
• Regularly: we check availability from outside, and operators are notified when an anomaly is detected.
• With every change to the system: we run automated tests and a check for leaked secrets.
• Our policy is to rotate long-lived credentials and shared secrets on a regular basis.

Assessment track record

• Since August 2026 we have carried out several in-house assessments based on threat modelling (in September and October 2026). We address the issues found in turn.
• Examples of fixes: stronger invalidation of authentication, least-privilege database permissions, added access restrictions on public surfaces, stronger input validation, and a review of what is written to logs.
• For risks that cannot technically be fully eliminated, we record a decision to accept the risk and keep monitoring.

What is not yet done and what is planned

• Third-party vulnerability assessment or certification: not yet obtained. We will announce it on this page once done.
• Multi-factor authentication for customer sign-in: currently optional. We are considering making it mandatory.
• Automatic blocking of suspicious sign-ins: currently in audit (record-only) mode. We will consider expanding it based on operating experience.
• Multi-region redundancy: we currently operate in the Tokyo region only.

Third-party verification

We have not currently received any third-party certification or audit. We perform a self-assessment with reference to industry standards such as the FISC Security Guidelines (14th edition). We provide the self-assessment results individually to customers who contact us. This does not guarantee compliance with any standard.

Reporting vulnerabilities and contact

Please send vulnerability reports and security enquiries to info@maprise.jp.

Disclaimer and updates