Information Security Policy

In providing IT solutions across cloud, data integration, ERP, BI, AI and open-systems development, Total Solution Co., Ltd. (the “Company”) is entrusted with important information related to our clients' businesses and systems. We consider protecting these information assets from threats such as leakage, tampering, loss and misuse to be one of our most important responsibilities in earning and keeping our clients' trust, and we hereby establish this Information Security Policy. All our officers and employees work to ensure information security in accordance with this policy.

This English version is a translation provided for reference. If there is any discrepancy between the English and Japanese versions, the Japanese version shall prevail.

1. Management responsibility and structure

The Representative Director bears ultimate responsibility for information security and provides the structure and resources needed to support it. We clearly define our internal rules and work continuously, as an entire organization, to maintain and improve information security.

2. Compliance with legal and contractual requirements

We comply with laws, regulations and norms concerning information security and the protection of personal information, as well as the security requirements set out in our contracts with clients.

3. Proper management of information assets

We manage the information assets we handle according to their importance and risk, and ensure their confidentiality, integrity and availability.

• Granting access rights only to those who need them for their work, and reviewing those rights regularly
• Applying technical measures suited to the risk, such as strengthened authentication and encryption of data in transit and at rest
• Preventing the loss or theft of computers, mobile devices and storage media, and maintaining thorough malware protection
• Securely erasing or disposing of information and storage media that are no longer needed

4. Protection of information entrusted by clients

We use information entrusted to us by clients only for the purposes defined in the contract, and we never remove, copy or disclose it to third parties without the client's permission. When working on-site, we follow the client's security rules; when working remotely, we ensure a secure working environment and secure means of communication. When the work is complete, we return or erase the information in accordance with the contract.

5. Secure system development and operations

We consider security at every stage of system design, development, testing and operations, prevent vulnerabilities from being built in, and manage changes and respond to vulnerabilities appropriately. We keep access to clients' production environments and data to the minimum necessary for the work.

6. Safe use of cloud, generative AI and other technologies

Before using new technologies such as cloud services and generative AI, we assess the risks and use them with appropriate configuration and controls. In particular, when using generative AI services, we make sure never to enter clients' confidential or personal information without the client's approval or appropriate safeguards.

7. Training and awareness

We provide ongoing information security training and awareness activities for our officers and employees so that each person handles information assets responsibly.

8. Incident response

If we become aware of an information security incident or signs of one, we promptly assess the situation, work to prevent further damage and report appropriately to our clients and other stakeholders. We also investigate the cause and take measures to prevent recurrence.

9. Continuous improvement

We regularly review this policy and our information security practices in light of changes in society, technology and our business environment, and continuously improve them.

Established: October 8, 2026
Total Solution Co., Ltd.
Mamoru Tahara, Representative Director & CEO