Security white paper

1. Introduction
This document describes WriteVideo's approach to security.
Service overview
WriteVideo is an AI-powered SaaS platform for video generation. It provides functions such as automatic video generation from PowerPoint and PDF, and AI narration generation.

2. Location and jurisdiction
WriteVideo is provided by X, Inc. (Toranomon, Minato-ku, Tokyo). The Company is a Japanese corporation, and the overall management of the development and operation of the service and its main business processes are carried out in Japan.
The system runs in Amazon Web Services (AWS) data centers in Japan, and customer data is stored in Japan. We implement redundancy across multiple sites.

3. Encryption
All data in transit and data at rest is encrypted.
Encryption of communications
All communications are encrypted with TLS 1.2 or higher.
Encryption of data at rest

• File servers: server-side encryption (SSE-S3 / SSE-KMS)

• Databases: encryption with AWS managed keys

• Backup data: all stored encrypted
  

4. Data management
Backup

• Important data (project files): real-time backup

• Other data: backup created every 24 hours

Data retention and deletion
For the Business Plan, we delete the data we hold at the request of the Subscriber.
Multi-tenant isolation
Each organization's data is logically isolated, and access control is implemented at both the application layer and the database layer.

5. Authentication and access control
We use Amazon Cognito as our authentication platform.

• Enforcement of a password policy

• Support for multi-factor authentication (MFA)

• Permission management through role-based access control (RBAC)

• Session timeout settings
  

6. Development practices

• Mandatory code review

• Vulnerability scanning of dependency libraries

• Security testing before deployment to the production environment

• Regular security checks

7. Monitoring and log management

• Recording of API operation logs with AWS CloudTrail

• Aggregation of application logs with CloudWatch Logs

• Integrated monitoring and alerts with Datadog

• Detection of and notification about unauthorized access attempts
  

8. Incident response
When a security incident occurs, we respond following a process of detection, containment, eradication, recovery and post-incident analysis.