Protecting Business Data with
Multi-Layer Security Design
DATAPIQ handles highly sensitive invoices and receipts. We adopt international security standards as design guidelines and implement defense-in-depth to protect your data.
SECURITY PILLARS
6 Security Pillars
Security requirements for business use are built in from the design stage.
Communication & Data Encryption
All communications are encrypted with TLS 1.2 or higher. Passwords are stored as bcrypt hashes — never in plain text.
Multi-Factor Authentication (MFA)
Supports email + one-time code 2-step verification, FIDO2/WebAuthn passkeys (biometric authentication), and Google social login.
Tenant Isolation
Company ID verification is applied to every data access. Our multi-tenant design ensures no cross-company data access is ever possible.
Attack Protection
- SQL injection protection (ORM parameterized queries)
- XSS protection (automatic escaping)
- CSRF protection (AntiForgeryToken)
- Rate limiting & brute-force protection
Security Headers
- Content-Security-Policy (CSP)
- X-Frame-Options: DENY
- X-Content-Type-Options: nosniff
- Strict-Transport-Security (HSTS)
- Referrer-Policy
Audit Logs
All logins, operations, and errors are recorded. Administrators can review operation logs, and AI token usage is tracked — providing a foundation for anomaly detection.
DEFENSE IN DEPTH
Defense-in-Depth Architecture
We adopt "defense in depth," not relying on any single defensive measure. Even if an outer layer is breached, inner layers continue to protect sensitive data.
OWASP TOP 10
Designed Against International Threat Standards
Using the OWASP Top 10 risks — defined by the international web application security organization — as design guidelines, we have implemented countermeasures for each threat category.
OWASP Top 10 is an international indicator of web application security risks defined by the Open Web Application Security Project. DATAPIQ uses it as a design guideline but has not received OWASP certification.
FRAMEWORKS & STANDARDS
Referenced International Standards & Frameworks
While we have not obtained certifications, we adopt the principles of each international standard as guidelines for design and operations.
OWASP Top 10
Adopted the Top 10 web application risks as design guidelines. Countermeasures for each category are implemented.
Not certified, but adopted as a design guideline.
ISO/IEC 27001
International standard for information security management. We incorporate its approach to access control, risk management, and audit logs.
Not certified, but adopted as a design guideline.
PCI DSS
Payment processing is fully delegated to Stripe, which holds PCI DSS Level 1 certification. Card information does not pass through our servers.
Certified by Stripe
Personal Information Protection Act
Based on Japan's Act on Protection of Personal Information (APPI), we minimize data collection, manage it appropriately, and restrict third-party disclosure.
Legal compliance (see Privacy Policy)
PAYMENT SECURITY
Payment Security
Credit card information is never stored on or passed through DATAPIQ's servers. All payment processing is delegated to Stripe, which holds PCI DSS Level 1 certification.
PAYMENT FLOW
RESPONSIBLE DISCLOSURE
Vulnerability Disclosure
If you discover a security vulnerability, please contact us through our inquiry form before public disclosure. We will review your report and respond in good faith. Note that this does not apply to malicious use.
Last updated: May 2, 2026 | The contents of this page are subject to change without notice.