Vendor Security
The English user guide is currently in beta preview. Most of the documents have been automatically translated from the Japanese version. Should you find any inaccuracies, please reach out to Flatt Security.
This page summarizes the security posture of Shisho Cloud byGMO and Takumi byGMO, operated by GMO Flatt Security Inc. It is written to support your internal review processes and security questionnaire responses.
This page covers cross-cutting security topics that apply to our services as a whole. Product-specific behavior (assessment data retention, Takumi Guard's registry proxy operation, Runner VM isolation, etc.) is documented in the feature pages of each product. Please refer to both as needed.
Compliance
ISO/IEC 27001 (ISMS)
GMO Flatt Security Inc. has obtained certification against the international standard for information security management systems, ISO/IEC 27001 (ISMS).
| Item | Detail |
|---|---|
| Standard | JIS Q 27001:2025 (ISO/IEC 27001:2022 + Amd 1:2024) |
| Scope | (1) Security assessment, penetration testing, consulting, incident response, research, and educational services (2) Planning, development, and operation of information-security cloud services |
| Certificate number | JP26/00000054 |
| Certifying body (accreditation number) | SGS Japan Inc. (ISR021) |
| Initial certification | February 17, 2026 |
| Valid through | February 17, 2029 |
The current certification status is publicly listed on the ISMS-AC registry: JP26/00000054. For further details, please reach out via the contact channel at the bottom of this page.
Data Handling
Residency
Customer data is stored in Japan regions by default. A subset of operational metadata and SaaS-side logs follow the hosting region of each respective SaaS provider.
Retention Periods and Deletion
Customer data associated with a Shisho Cloud organization is deleted in accordance with the organization's lifecycle (cancellation and organization-deletion procedures). For the deletion procedure itself, see Organizations > Deleting an organization.
Input data received during the processing of individual features may be deleted on a shorter cycle. For example, source code and related input files provided to the assessment features are deleted within the minimum period required to provide the feature.
If you wish to request deletion of personal data in accordance with applicable laws and regulations, see How to Delete Individual's Data.
Provisions for AI/LLM Usage
This section applies only when you use AI-powered features of Takumi byGMO. When you only use features that do not involve AI, customer data is not sent to the inference providers below.
Takumi byGMO's AI features rely on external inference providers. The inference providers we can disclose at this time include the following:
- Google Cloud Vertex AI
- AWS Bedrock
- Anthropic API
With any of these providers, customer data is not used to train the LLMs.
Inference may run in regions of the above providers outside Japan. We do this because few frontier models are both available on these providers and able to run inference entirely within Japan. Many other services with AI features likewise cannot keep inference within Japan, even when data can be stored in Japan. For example, ChatGPT, provided by OpenAI OpCo, LLC, lets customers store data in Japan, but Japan is not among the regions supported for inference residency (as of September 2026).
Where possible, we ask inference providers to apply zero data retention (ZDR), a setting under which input data (prompts and outputs) is not retained. However, when usage restrictions on frontier models with advanced cybersecurity capabilities are relaxed, providers typically require data to be retained for a period of time to prevent misuse (for example, Anthropic's Cyber Verification Program). We therefore cannot guarantee ZDR in every case.
Even where data is retained, the retained data is not used to train AI models, and retention is kept to the minimum necessary. Its purpose is limited to the provider's abuse monitoring, system security, and compliance with legal obligations, and its period stays within what each provider's specifications define.
In addition, we minimize the risks of using our AI features by only using inference providers for which we have confirmed the following through their terms of service and other agreements (such as DPAs):
- Input data is not used to train AI models
- Their terms include reasonable confidentiality obligations, such as a prohibition on use for other purposes
- They enable compliance with applicable laws on the supervision of subcontractors and cross-border data transfers (including the standards set by Japan's Act on the Protection of Personal Information and the rules of the Personal Information Protection Commission)
- They hold external information security audits or certifications, such as SOC 2 or ISO/IEC 27001
The set of providers may change over time as we improve quality and adopt new models. We do not disclose the specific model names or version configurations we actually run on the above inference providers.
The inference-region and ZDR constraints above may be relaxed under special arrangements. For details, please contact your sales representative or our support team.
Contact
For security-related inquiries, vulnerability reports, and requests for certification details, please see the Contact page.
Frequently Asked Questions (FAQ)
Can you respond to security questionnaires?
Yes, provided you are on or trialing a Takumi subscription. Please note that, given the volume of inquiries we receive, we cannot accommodate this for free-tier-only use.
Where is the Privacy Policy?
See the GMO Flatt Security Privacy Policy.