Information Security Policy
Timelab Inc. (hereinafter "the Company") develops and provides cloud services and applications centered on calendars and scheduling (such as Lynx and Calico), and supports the planning and development of software for its customers (Penguin Studio). Through these businesses, the Company is entrusted with important information such as customers' schedule information, personal information, and confidential business information, and provides software that handles such information on customers' devices.
The Company regards protecting its customers' information and its own information assets from threats such as cyberattacks, human error, system failures, and disasters as the foundation of the trust placed in it by customers and society, and as one of its most important management priorities. To this end, the Company establishes this Policy and continuously maintains and improves the confidentiality, integrity, and availability of information.
Scope
This Policy applies to all of the Company's businesses and organizations; to the directors, employees, temporary staff, and seconded staff engaged in the Company's business (hereinafter "Personnel"); and to all information assets handled by the Company in its business, including information entrusted to it by customers and the devices, cloud services, and systems that handle such information.
Policy
1.Management Responsibility
Management is responsible for information security and secures the necessary resources. Based on this Policy and the results of risk assessments, management sets information security objectives, reviews their achievement, and continuously improves the information security management system.
2.Information Security Organization
The Company appoints an information security officer, defines roles, responsibilities, and authorities, and establishes security measures as internal rules. Compliance and effectiveness are verified through regular reviews and internal audits.
3.Education and Training
The Company continuously provides education and training so that Personnel understand this Policy and related rules and can fulfill their roles.
4.Compliance with Laws and Contracts
The Company identifies and complies with relevant laws and regulations, including the Act on the Protection of Personal Information, industry standards, and the security requirements set out in contracts with customers.
5.Providing Secure Services
The Company builds security into every stage of its services and deliverables, from planning and design through development, delivery, and operation, and continuously addresses vulnerabilities. The Company also verifies the security of, and appropriately manages, external services used in its business, such as cloud services and generative AI, as well as its subcontractors.
6.Risk Assessment
The Company identifies its information assets and regularly assesses risks according to their importance and the threats they face. Based on the results, the Company systematically implements measures to prevent unauthorized access, leakage, tampering, and loss.
7.Incident Response and Business Continuity
The Company establishes procedures for detecting, reporting, responding to, and recovering from incidents. When an incident occurs, the Company responds promptly, notifies customers and relevant authorities as appropriate, and prevents recurrence. The Company also prepares to continue its business and recover quickly in the event of system failures or disasters.
Policy Framework
This Policy is the Company's highest-level policy on information security. Policies and rules tailored to the characteristics of specific businesses and services (such as thePenguin Studio Information Security Policy(Japanese only) and the Cloud Service Information Security Policy) are established based on this Policy. If any of them conflicts with this Policy, this Policy prevails and the subordinate policy or rule is revised.
The handling of personal information is set out, as a policy standing alongside this Policy, in the Company's Privacy Policyand in the privacy policies established for each service. This Policy supports the security management measures set out in those policies from the standpoint of information security.
This Policy is communicated to all Personnel and published on the Company's website.
Established: November 11, 2026
Timelab Inc.
Yusuke Hozumi, CEO