Security & Trust Center

Security is built into the foundation.

How Kiriwake protects HR data, what we have checked and how, where the gaps are, and how to report a vulnerability. Current controls are kept separate from planned work, and every result has a date.

Data protection and encryption

Encryption in transit: Connections between your browser and Kiriwake use HTTPS with TLS 1.2 or 1.3 only. HTTP requests are redirected to HTTPS, both the website and the API send HSTS, and the connection between the servers and the database is encrypted with TLS.
Field-level encryption of personal data: Employee names, contact details, addresses and dates of birth, family details, year-end declarations, payslips, clock-in and clock-out times, expense details, and the content of requests and activity history are encrypted field by field before they are stored (AES-256-GCM). Each encrypted value is bound to its organization and record, so it cannot be read if moved to another record.
Key management: Encryption keys are managed in AWS Key Management Service (AWS KMS), separately from the database. Permission to decrypt is limited to what operating the service requires.
Encrypted storage: Database storage, backups and document files are also encrypted with the cloud provider's encryption.
Scope of encryption: Some fields used for totals and search, such as work dates, worked hours and expense amounts, are not encrypted field by field (they are still on encrypted storage). Encryption does not replace access control: authorized users see decrypted content.

Access control and isolation between organizations

Role-based permissions: Owner, admin, member, viewer and employee roles limit what each person can do and see. Settings and approval decisions are limited to the roles allowed to make them.
Sensitive fields hidden by role: Sensitive fields such as dates of birth and addresses are not shown to viewers and are left out of the CSV files viewers export.
Separation by organization: All business data belongs to an organization, and the server returns only data of the organization the signed-in user belongs to. Automated tests check every API that addresses a record by its id for access from other organizations.
Approval permissions: Employees handle only their own records and requests. Managers decide only their reports' requests, and nobody can approve their own request or a request about themselves.
Employee portal links: Links use hard-to-guess random values, and the server stores only a hash. Staff can revoke a link at any time, and archiving the employee revokes it automatically.
Closed by default: API endpoints answer only signed-in users unless they are deliberately public (sign-in, sign-up and the employee portal), so a new endpoint cannot become public by mistake.

Authentication and account security

Mandatory two-step verification: Every account must verify its email address and turn on two-step verification (an authenticator app or an email code). Recovery codes are available for when the app cannot be used.
Sign-in protection: Sign-in attempts and API requests are rate-limited, short and common passwords are refused, and requests are protected against CSRF.
Session protection: Sessions use HttpOnly, Secure cookies. They end after 8 hours without activity (automatic background refreshes do not count) and at most 12 hours after sign-in. Session identifiers are not stored in their original form.
Protection on security changes: Changing the password or two-step verification signs out other devices, and the change is announced by email.

Document storage and file access

Private storage: Uploaded documents, receipts, distributed documents and payslip PDFs are stored encrypted in storage without public URLs.
Access checked by the server: Files are delivered only after the server checks the signed-in user's permissions, and browsers and proxies are told not to cache them.
Only the employee and authorized staff: Payslips and distributed documents can be viewed only by the employee concerned and authorized staff. Payslips are shown on screen only after the employee consents to electronic delivery.
File validation: Only PDF, JPEG and PNG files are accepted, and the format is checked from the file content, not the extension.

Activity history and logs

Activity history: Key actions on employees, cases, documents, requests and settings are recorded with who did them and when. The history content is stored encrypted.
Account security log: Sign-ins, wrong passwords and codes, sign-outs and changes to two-step verification are recorded per account, and each user can see their own record.
No personal data in logs: Application logs record ids and error types only, never names or document content (checked by automated tests).

Backups and data lifecycle

Backups: The database is backed up automatically every day, and backups are encrypted.
Document retention: Each organization sets how long document files of completed or cancelled cases are kept, from 30 days to 10 years.

Data handling

Year-end adjustment data: Year-end declarations are stored exactly as the employee submitted them, and changes from correction requests or resubmissions are kept as revision history. Viewers cannot see declaration data.
No My Number: Kiriwake does not collect My Number (Individual Number). We ask customers not to upload documents containing a My Number or health information such as medical check results.
Opt-in AI processing: AI document processing is off by default. Only when an organisation admin enables it are documents processed through an external AI provider’s API.
Minimal data sent to AI: Only the document file and its document type are sent for AI processing — not employee names or other information stored in Kiriwake. The provider’s handling of data follows its own terms; we will tell you which provider is used during onboarding.
Retention and deletion: Each organisation can set how long document files from completed or cancelled cases are kept (30 days to 10 years), and a deletion process removes files after that period.
Automatic receipt reading is optional: Automatic reading of expense receipts works only when an organization admin has turned on AI processing. Only the receipt file is sent, never names or other registered data. Results are estimates the employee checks before saving.
Records that must be kept by law: Attendance and leave records and expense claims with receipts are not deleted automatically, because labor and tax laws require them to be kept. Deletion requests are handled together with the customer organization, taking legal retention periods into account.

Standards and frameworks we use as guidance

Our security practices are informed by internationally recognized frameworks, including ISO/IEC 27001.

ISO/IEC 27001:2022: The international standard that sets the requirements for an information security management system (ISMS). Its approach of choosing controls based on risk is our main reference.
ISO/IEC 27017 and ISO/IEC 27018: We refer to the parts relevant to Kiriwake of the information security controls for cloud services (ISO/IEC 27017) and the code of practice for protecting personal data processed in public clouds (ISO/IEC 27018).
NIST Cybersecurity Framework 2.0: We use the framework of the U.S. National Institute of Standards and Technology (NIST) as a reference when organizing our security work.
OWASP ASVS: The OWASP Application Security Verification Standard guides how we design and check authentication, access control and data protection.

Kiriwake is not certified to ISO/IEC 27001, ISO/IEC 27017 or ISO/IEC 27018. We do not claim conformity with these standards or a third-party assessment such as SOC 2.

Assessment results

Free, independent checks that anyone can run again against our public hosts, and automated checks of our code and dependencies. Last updated on 6 November 2026.

Last updated 6 November 2026

TLS configuration: kiriwake.jp
A+
Qualys SSL Labs. Only TLS 1.2 and TLS 1.3 are accepted, and the website sends HSTS for one year.
Run this check again
TLS configuration: api.kiriwake.jp
A+
Qualys SSL Labs. Only TLS 1.2 and TLS 1.3, HSTS for one year, and forward secrecy with every tested client.
Run this check again
HTTP security headers: kiriwake.jp
B (75/100)
Mozilla HTTP Observatory. The website sends HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy and Cross-Origin-Opener-Policy. Points are still deducted because its Content Security Policy is in report-only mode.
Run this check again
HTTP security headers: api.kiriwake.jp
A+ (135/100)
Mozilla HTTP Observatory. The API sends a strict Content Security Policy, HSTS and the other recommended headers. A load-balancer cookie without the Secure attribute is the only remaining deduction.
Run this check again
Known vulnerabilities in dependencies
0
pip-audit (Python) and npm audit (JavaScript packages used in production), after the October 2026 updates. Both checks now run automatically on every code change.
Secrets in source code and history
0 found
Automated scans of every source file and the full change history found no credentials or keys. Each automated match was reviewed by hand.

These are point-in-time results. A good grade does not mean a service has no vulnerabilities, and these checks do not replace a penetration test.

OWASP ASVS 5.0 self-assessment

We reviewed the application against every requirement of the OWASP Application Security Verification Standard 5.0.0, using evidence from the code, the tests and live checks.

Level	Requirements	Met	Partly met	Not met	Not verified	Not applicable
L1	70	46	12	1	0	11
L2	253	105	64	9	5	70

This is our own assessment, not a certification or an independent audit; OWASP does not certify applications. Level 2 includes the Level 1 requirements. No level is fully met yet. "Not applicable" covers features Kiriwake does not have, such as OAuth and WebSockets.

The detailed assessment, with the evidence for each requirement, is an internal document. For a security review, please contact us.

Known limitations

What we do not have or have not done yet. We list these so that you can judge the service accurately.

No certification or third-party attestation: we hold no ISO/IEC 27001, ISO/IEC 27017 or ISO/IEC 27018 certification and no SOC 2 report. For the same reason, this page shows no security badges.
No third-party penetration test has been carried out yet. The results on this page come from free automated checks and our own review.
The website's Content Security Policy runs in report-only mode: browsers check it but do not yet block anything that breaks it.
Uploaded files are checked for their format but not scanned for malware.
Database backups are kept for a short period, and a restore from backup has not been rehearsed yet.
Our incident response procedure is written down but has not been rehearsed, and security alerts are not yet sent to a person automatically.
Organization owners cannot yet remove a staff member's access or end their sessions themselves. Please contact us when this is needed.
Google Analytics and Cloudflare Web Analytics run on the public website pages. They are not loaded in the app or the employee portal.

Report a vulnerability

If you believe you have found a security vulnerability in Kiriwake, please tell us privately. We acknowledge reports within 3 business days (Japan time) and keep you informed until the issue is fixed.

Tell us the page or feature, the steps to reproduce and the impact you expect.
Do not access, change or keep data that is not yours, and do not test with other organizations' accounts.
Do not run denial-of-service tests, high-volume automated scans or social engineering.
Please give us time to fix the issue before you disclose it publicly.
We do not offer a paid bug bounty.

Contact form

Next steps

The following are not available or in place today. We prioritize them based on pilot feedback.

Single sign-on (SSO)
IP address restrictions
Activity history export
Third-party security assessment (e.g. penetration testing)
Enforcing the Content Security Policy on the website
Malware scanning of uploaded files
Regular incident response drills
Longer backup retention and regular recovery drills
Automatic deletion of document files after their retention period

Security questions

For security questionnaires or questions about how data is handled, please use the contact form. To report a vulnerability, see "Report a vulnerability" above.