Information Security Policy

1. Basic policy

Through “Invoi” (the “Service”), its service for creating invoices and other business documents, 2Blue Inc. (株式会社２Ｂｌｕｅ; “we” or “us”) looks after information about users' businesses, clients and transactions. Protecting this information is a precondition for providing the Service, and we work on information security according to the following policy.

1. We handle the information entrusted to us only as far as needed to provide the Service, and limit who can handle it to the staff who need to.
2. We comply with the Act on the Protection of Personal Information, other laws on information security, and our contractual obligations.
3. We choose external services after checking the security measures and other information their providers publish, and use them only as far as needed.
4. If an information security incident occurs or may have occurred, we promptly establish the facts, prevent further harm, remove the cause and work to prevent a recurrence. Where the law requires, we report to the Personal Information Protection Commission and notify the people affected.
5. We keep reviewing this policy and our measures as technology changes and new threats appear.

2. Main measures

We currently take the following measures.

• Encryption in transit: all communication with the Service is encrypted with HTTPS.
• Encryption at rest: the database is stored with PlanetScale (AWS Tokyo region), and image and PDF files with Cloudflare R2. Both companies state publicly that they encrypt stored data (for PlanetScale, including backups).
• Backups: the database is backed up regularly and automatically by PlanetScale.
• Sign-in without passwords: you sign in with a Google account or a six-digit confirmation code sent by e-mail. A code expires after 10 minutes, can be tried at most 5 times, and is stored in hashed form. We do not store passwords.
• Access control by business: every read and write of data is limited to the business that the signed-in member belongs to. Which business the data belongs to is decided on the server, never from values in the request.
• Permissions by role: each member is an Owner, an Admin or a Member, and only Owners and Admins can change a business's settings and members.
• Keeping issued versions: each time a document is issued, its content at that moment is frozen together with a hash value and stored with its PDF, so what a client received can be shown later.
• Activity records: changes in a business are recorded with the type of action, the member who took it and the time, and the business's members can check them.
• Protecting the pages used for PDFs: the print pages used to create PDFs of users' documents open only with a signed token that is valid for 5 minutes.
• Share links: share links for clients use long random strings that are hard to guess. Anyone who knows a link can view the document, so give it only to the client. You can revoke a link at any time when it is no longer needed.
• Text for AI input: text pasted for AI input is sent to Anthropic over an encrypted connection and is not stored in the Service. We keep only a record of each reading: the time, the member who used it, the name of the model used and the number of tokens.
• Restricted access to production: only our staff who need it for their work can access the production systems.
• Sending address: e-mails from the Service (sign-in confirmation codes) are sent from noreply@invoi.jp.

3. External services

The Service uses external services such as Cloudflare (delivering the website, running the application, storing files and creating PDFs), PlanetScale (database), Resend (sending sign-in confirmation codes), Google (sign-in) and Anthropic (reading text for AI input). The purpose of each service and where data is stored are described in the Privacy Policy. The advertising shown on the Free plan is shown by us, and no third-party ad tags or scripts run on the Service's screens.

4. Reporting security issues

If you find a vulnerability in the Service or notice that an account may be being misused, please contact us at info@blueblue.jp.

• Please tell us what we need to check the issue, such as the steps to reproduce it and its impact.
• Please do not access other users' data or disrupt the Service in order to check the issue.
• Please do not make the vulnerability public until we have finished dealing with it.

We will review each report and take the necessary action.