Trust Center
Security and data at Kizunatap
What we have and what we do not have yet, written down as checked facts only.
Five key points
-
Where data is stored
Malaysia (Kuala Lumpur)
Off-site backups: Cloudflare R2 (30 days). 6 subprocessors handle personal data (countries: Malaysia, United States). Subprocessor list
-
Encryption in transit
Yes
All traffic is HTTPS (TLS 1.2+, Let's Encrypt via Traefik 2.11 defaults).
Encryption at rest: server disk No / backups Yes. Details
-
Third-party certification
Held: None
Next step: Standard answers to security questionnaires (items following ISO 27001 Annex A and the MIC guidelines). 2026-10. Roadmap
-
Incident notice target
First notice within 72 hours of discovery (business days; confirmed facts only)
-
Data when you leave or delete
Email request, deleted by hand
To delete a whole user account (cancellation), email us; the operator (the representative) deletes it from production data by hand. There is no self-serve deletion screen yet.
Deleted data stays in backups for up to 14 generations (on the server) / 30 days (R2), then ages out. How deletion works
Overview and architecture
Automate & Augment, Inc. operates Kizunatap, a business card service. Everything on this page was checked against configuration, logs and code; the date each item was last checked is shown in the tables and in each section.
One Docker container (Node.js / Hono) with SQLite on a single VPS behind Traefik (TLS). Card reading (OCR + AI) runs on an operator-controlled Mac mini worker that writes results back through the API.
| Component | Location | What it holds | Checked |
|---|---|---|---|
| Web/API (kizunatap.com) | Hostinger VPS (Kuala Lumpur, Malaysia) | name-card contents, contacts, memos, images, account data (SQLite + files on the Docker volume) | 2026-10-26 |
| Reader worker | Operator's Mac mini (Tokyo, Japan) | card images and extracted text only while a job runs; temp files deleted per job | 2026-10-25 |
| Backups | On the VPS (14 daily generations) + Cloudflare R2 (30 days) | full SQLite backup (contact data) | 2026-10-26 |
Third-party certification
Third-party certifications held None
No third-party certification (ISO 27001 / 27017, Privacy Mark, SOC 2, ISMAP) is held today. We do not display badges or claim compliance we do not have.
The order we plan to take these on and what starts each one. Where we cannot promise a date, we state the condition instead.
| Item | Status | Condition or timing |
|---|---|---|
| Standard answers to security questionnaires (items following ISO 27001 Annex A and the MIC guidelines) | In progress | 2026-10 |
| External vulnerability assessment (one web application) | Waiting on a condition | When the first company customer on a paid plan asks for it |
| ISMS (ISO/IEC 27001) | Waiting on a condition | At 5 company customers, or when a security review says it is required |
| ISMS cloud (ISO/IEC 27017) | Waiting on a condition | After ISMS |
| Privacy Mark (Japan) | Waiting on a condition | If Japanese company customers ask for it more often than ISMS |
| SOC 2 Type II | Waiting on a condition | When a US company customer or a large customer asks for it |
| Encryption at rest (VPS disk / DB columns) | Waiting on a condition | At the next infrastructure change |
| Restore drill from a backup | Planned | 2026-11 |
Operating company's self-declaration (separate from certification)
Automate & Augment, Inc., the company that operates Kizunatap, has made a two-star self-declaration under SECURITY ACTION, a program of Japan's Information-technology Promotion Agency (IPA) (self-declaration ID 50000355284, declared 2026-09-25). A company-level declaration (IPA allows one declaration per legal entity), not a declaration about the Kizunatap product. SECURITY ACTION is a self-declaration program, not an IPA certification, and IPA does not vouch for the security of Kizunatap as a product.
Information security policy used for the declaration (operating company) / IPA declarant search (in Japanese)
Laws and regulations
Act on the Protection of Personal Information (APPI): purposes of use specified and published, security control measures, supervision of contractors, information to the person about provision to third parties in foreign countries (sending to US companies = privacy §4-5), reporting and notification of leaks, and requests for disclosure, correction, suspension of use and deletion (privacy §7).
Parts not yet given a final review by a lawyer are marked in the privacy policy.
GDPR: we do not offer or market the service to the EU / EEA and do not monitor the behavior of EU residents, so we consider it out of scope. Requests from EU residents (such as deletion) are handled through the same contact.
CCPA / CPRA: we are below the California business thresholds (annual gross revenue, number of consumers), so it does not apply.
Checked: 2026-10-26
Organizational measures
- Operator
- Automate & Augment, Inc.
- Who can access production data
- Only the representative (one person) can touch production data; no shared accounts; admin login is a dedicated secret-backed cookie.
- Secrets management
- API keys, login links, session secrets and invite codes are stored as SHA-256 hashes only (shown once at issue). Runtime secrets come from Infisical at deploy time; none are committed.
Checked: 2026-10-26
Encryption, location, retention and deletion
- Encryption in transit Yes
- All traffic is HTTPS (TLS 1.2+, Let's Encrypt via Traefik 2.11 defaults). HSTS one year. No plaintext HTTP.
- Encryption at rest (server) No
- The VPS disk (ext4) is not encrypted at the OS/application level; provider-side storage encryption is unverified.
- Encryption at rest (backups) Yes
- Backups in Cloudflare R2 are encrypted at rest by R2 (Cloudflare's documented behavior).
- Data location
- Malaysia (Kuala Lumpur) (per component: overview table)
| Data | Kept for |
|---|---|
| Card images, contacts, memos | Until the user deletes them or the person asks for deletion |
| In-progress reading data (worker temp folder) | Deleted after each job |
| Unfinished sign-up data | Deleted after 24 hours |
| Backups (on the server / R2) | 14 generations / 30 days |
| Application logs | 10 MB × 3 files (days to a few weeks) |
| Audit log | 400 days (being built) |
| Card-page visit records (IP as a salted hash) | No automatic expiry (no expiry set yet) |
How deletion works
- Deleting a whole account (cancellation)
- To delete a whole user account (cancellation), email us; the operator (the representative) deletes it from production data by hand. There is no self-serve deletion screen yet.
- Deleting exchanges and contacts (users)
- Users can delete exchanges and contacts in the dashboard or through the API; deleting them also removes the photo files.
- Deleting a counterpart card page
- When a recipient deletes their counterpart card page (email check, then deletion, then a confirmation email), only that page, its sign-in and what they edited are removed. The contact records kept by the user who handed them the card (exchanges, contacts, photos) stay; that user manages them.
- Backups after deletion
- Deleted data stays in backups for up to 14 generations (on the server) / 30 days (R2), then ages out.
Checked: 2026-10-26
Sign-in and access control
- User sign-in
- No passwords. Email login links (24 h, single use) and Google sign-in (OIDC + PKCE, currently disabled). Sessions last 30 days in HttpOnly / Secure / SameSite=Lax cookies.
- API keys
- Owner-issued API keys with scopes (SHA-256 at rest); the same key serves REST and MCP.
- Isolation between customers
- Every operation is authorized per owner; another owner's rows answer 404. An isolation test suite checks every operation × principal on each build.
- Multi-factor authentication Not applicable
- There are no passwords, so MFA does not apply (a login link proves control of the mailbox; through SSO, the identity provider's MFA applies)
| Action | Limit |
|---|---|
| Sign-in | 20 |
| Admin login | 10 |
| Sign-up | 10 |
| Card page views | 120 |
Checked: 2026-10-26
Data sent to AI
- What may be sent
- For card reading and draft messages, card images, extracted contacts and the owner's memos may be sent to OpenAI (US) models through the operator's worker (Codex app-server).
- What is never sent
- Claiming a handed-out tag (registering your own card) and self-serve signup cards never go to the AI (local OCR only). AI reading has a per-owner monthly cap; past the cap only OCR runs.
- Use for training Unknown
- How long OpenAI keeps the data and whether it is used for training is still being confirmed. Until then we do not say it is not used for training.
- Records
- Every reading records the model, tokens, unit price, outcome and retries (cost ledger).
Checked: 2026-10-26
Logging and monitoring
- Application logs
- Application logs are JSON lines kept by the container (10 MB × 3 files = short-term). No bodies, tokens or keys are logged.
- Card page view records
- Card page views store a salted hash of the IP address (raw IPs are not stored).
- Audit log Planned
- An audit log of operations (who, when, what) is being built, with 400-day retention planned.
- Monitoring
- External HTTP monitoring (UptimeRobot) and a server-side monitor; alerts go to the operator as push notifications
Checked: 2026-10-26
Availability, backups and incident contact
- Uptime guarantee (SLA) None
- We do not offer an uptime guarantee (SLA).
- Releases
- Blue/green switch (no downtime) and a rollback script
- Backups
- Daily 03:30 JST online SQLite backup with an integrity check. 14 generations on the server, off-site in Cloudflare R2 (30 days).
- Restore drill No
- No restore drill yet (booting a separate environment from a backup). (roadmap)
- Detection
- External monitoring, server monitoring and an immediate push notification to the representative.
- Customer notice target
- First notice within 72 hours of discovery (business days; confirmed facts only)
- Response steps
- Detect, scope the impact, contain (revoke keys, stop services), contact affected users, report to the Personal Information Protection Commission when Article 26 of the APPI applies (preliminary report within 3-5 days, final report within 30 days), then prevent recurrence. Runbook: docs/security/incident-response.md.
- History
- Incidents so far: none
Checked: 2026-10-26
Security features you control
- Sign-in methods
- No passwords. Email login links (24 h, single use) and Google sign-in (OIDC + PKCE, currently disabled). Sessions last 30 days in HttpOnly / Secure / SameSite=Lax cookies.
- Issuing and revoking API keys
- Owner-issued API keys with scopes (SHA-256 at rest); the same key serves REST and MCP.
- Company SSO and SCIM Planned
- Company SSO (OIDC / SAML) and SCIM are designed and being built (EE).
- Audit log Planned
- An audit log of operations (who, when, what) is being built, with 400-day retention planned.
For differences between plans, see Compare plans.
Subprocessors
6 subprocessors handle personal data; they are located in Malaysia, United States.
| Provider | Purpose | Country | Personal data | Notes |
|---|---|---|---|---|
| Hostinger International Ltd. | Hosting (app, database, images) | Malaysia (Kuala Lumpur) | Yes | |
| Cloudflare, Inc. | DNS, registrar, backup storage (R2) | United States (global network) | Yes | |
| Resend, Inc. | Transactional email (receipts, login links, card emails) | United States | Yes | |
| OpenAI (OpenAI, L.L.C. / OpenAI OpCo) | Card reading and draft messages (AI) | United States | Yes | Exact contracting entity still being confirmed (same as privacy §4) |
| Google LLC | Google sign-in (opt-in, currently disabled) | United States | Yes | |
| Pushover (Superblock, LLC) | Operator push notifications (include the counterpart's company, name, title) | United States | Yes | |
| Stripe, Inc. | Payments (paid plans, not yet open) | United States | No | Billing details will be in scope once paid plans open |
| Infisical | Secrets management | United States | No | |
| UptimeRobot | External uptime monitoring | EU / United States | No | |
| GitHub, Inc. | Source code hosting | United States | No |
Reporting a vulnerability
- Where to report
- security@kizunatap.com (security.txt)
- Response times
- We reply to confirm receipt within 3 business days; fixes take 7-90 days depending on severity
- Safe harbor
- We take no legal action against good-faith reporters (testing that exfiltrates or destroys production data or stops the service is not allowed)
- Bounty
- No bug bounty
Checked: 2026-10-26
Security questionnaires
Standard answers to security questionnaires (items following ISO 27001 Annex A and the MIC guidelines): In progress
To request a security questionnaire or documents, or to ask about anything not covered here, write to contact@kazuyahibara.com.
Contact
Automate & Augment, Inc.: contact@kazuyahibara.com
Change history
- First version