Nulab Security Whitepaper
Ver 2.0
9.18.2024

Nulab Inc.

Nulab Security Whitepaper

Table of Contents
Table of Contents
1. Policy and Structure
Policy of Nulab Inc. (“us”, “we” or “Nulab”)
2. Separation of Responsibilities
Responsibilities of Nulab.
Responsibilities of the user
3. Location of Data Storage
4. Deletion
5. Labeling Mechanisms
For All Services
Teams (excluding Backlog Classic Plan)
Backlog
Projects
Team Function (Backlog Classic Plan only)
Cacoo
Folders
Typetalk
Topics
6. Adding and Deleting Users
For All Services (Excluding Backlog Classic)
User Registration
Delete Users
Invite to an Organization
Remove from an Organization
Backlog (Classic Plan)
Nulab Pass
7. Access Rights Management
For All Services (Except Backlog Classic)
Backlog
Backlog (Classic Plan)
Cacoo
Typetalk
Nulab Pass
8. How to Set Password
Nulab AccountInitial Password
How to Change Password
Backlog (Classic Plan)

1

Nulab Security Whitepaper

Initial Password
How to Change Password
Nulab Pass
9. Encryption
User Information
Correspondence with the Services
10. Manage Changes Management to the Services
11. Manuals
12. Backup
For all Nulab Services
Nulab Apps / Nulab Pass
Backlog
Cacoo
Typetalk
13. Time zone information for logs
14. Information for Vulnerability Management
15. Secure Development Life Cycle
16. Incident Response
17. Protection and Third Party Provision of User Data
18. Governing Law
19. Authentication【Scope of ISMS Cloud Security Certification Registration】
20. Use of Third-Party Service Providers
Revision History

2

Nulab Security Whitepaper

1. Policy and Structure
Policy of Nulab Inc. (“us”, “we” or “Nulab”)
We have established a Basic Policy on Information Security. We will comply with this basic policy andpractice activities to maintain information security such as the confidentiality, integrity, and availability of
information assets.

Security System
We maintain appropriate technical and organization measures, internal controls and information security
system, in order to protect User Data from loss, damage or alteration due to force majeure, unauthorizedaccess or leakage, or destruction through illegal acts. We implement appropriate measures from various
perspectives, including organizational, human, technical, and physical, and maintain and manage them.

2. Separation of Responsibilities
Responsibilities of Nulab.
We will implement the following security measures.
●●●●

Security measures for the services provided by us (Backlog, Cacoo, Typetalk, Nulab Apps(*1),
Nulab Pass)
Protection of user data stored in the above services
Middleware, OS and other infrastructural security that is required for the provision of the above
services
Appropriate management of accounts involved in the operation of the above services(registration, deletion, granting of administrative privileges, etc.)*1
Nulab Apps is the shared account (“Nulab Account”) etc. functionality provided by Nulab.

Handling of User Data
Our employees will never process user data without the approval of user. Our employees are underconfidentiality obligations which survive any termination of their employment.
Except for the limited cases described in the Term of Service or related agreements or Privacy Policy, we
will not transfer to a third-party user data collected through the use of the Service.

3

Nulab Security Whitepaper

We use user data for the following purposes:
1. User data will be used only for the purpose of providing the services to users, including
troubleshooting to prevent, detect or solve issues affecting the operation of the service, as well as
improving user data protection functions by detecting threats occurring and spreading (malware
or spam).
2. We will not disclose user data to law enforcement agencies unless otherwise required by law. In
the event that we are required by a law enforcement agency to disclose user data, we will requestthat such a law enforcement agency directly make such a request to users. As part of this process,we may provide Users’ basic contact information to the law enforcement agency. If thedisclosure of user data is compelled by a law enforcement agency, we shall make commerciallyreasonable efforts to notify the respective users prior to making such disclosure.

Responsibilities of the user
The user shall be responsible for implementing the following security measures.
●●●●

Proper management of password (Including the management of devices used for two factor
authentication)
Proper Account (*2) management (Grant of authorities for registration, deletion, administration
etc)
Proper management of registered contents
Registration of accurate contact information, such as an e-mail address, from which we can notifyyou*2Hereinafter, account might be referred to as user, however that should be all a reference to the account.

4

Nulab Security Whitepaper

3. Location of Data Storage
All data received by our customers is stored in the data centers of the cloud vendors outlined below.

Name of Service

Location of Data Storage

Nulab Apps

AWS (USA (Oregon))

Backlog

AWS (Japan (Tokyo))* In case of application from the Japanese website
AWS (USA (Oregon, Virginia))* In case of application from the English website

Cacoo

AWS (USA (California))

Typetalk

AWS (USA (Oregon))

Nulab Pass

AWS (USA (Oregon))* Data other than audit log
AWS (Japan (Tokyo))* Only audit log data

4. Deletion
If the Administrator follows the steps set forth by Nulab to terminate the use of the services (“Service
Termination Request”*1), we will delete the data received by the users (“User Data”).
Also, if a trial period ends without a submission of a request for a Paid plan, or if the Services are
terminated for reasons such as delayed payments, the User Data will be deleted.
In this case, upon completion of the deletion, the User Data cannot be retrieved even by Nulab.
Conditions for deletion, timing of deletion and the User Data subject to deletion are set forth in the tablebelow.
*1“Service Termination Request” means the below action.
● “Delete organization” in Nulab AccountConditions and timing of deletion
Conditions for deletion of User
Data

5Timing of deletion(General rule)

Nulab Security Whitepaper

Termination request has been
submitted

The deletion of User Data process
will start after 180 days haveelapsed following (i) the
termination of the current
agreement for Spaces under paidplans; or (ii) the submission of atermination request for Spaces
during paid plan trial periods orunder free plans, and will becomplete within 10 days of start*.

The trial period is ended without arequest for formal paid plans

The deletion of the Organization
will be automatically
implemented after 30 days fromthe end date of the trial period.
The deletion of User Data process
will start after 180 days following
the implementation of deletion of
the Organization and will becomplete within 10 days of start*.

The Services are terminated due
to payment delay or any otherreasons pursuant to the Article
9.1 of Nulab Terms of Service

The deletion of theOrganizations will be
automatically implemented after
90 days of the termination of theServices. The deletion of User
Data process will start after 180
days following theimplementation of termination
and will be completed within 10
days of start*.

Cacoo Plus Plan, and Free Plan
subscribed prior to November 27,
2019.

Deletion of Nulab AccountThe deletion of User Data process
will start upon deletion of the
Nulab account and will becompleted within 10 days ofstart*.

Backlog, Cacoo and Typetalkplans other than above

Deletion of Organization

The deletion of User Data process
will start after 180 days following
the implementation of deletion of
the Organization and will becompleted within 10 days ofstart*.

The trial period is ended without arequest for formal paid plans

The deletion of the Organization
will be automatically
implemented after 30 days fromthe end date of the trial period.

Backlog Classic Plan

6

Nulab Security Whitepaper

The deletion of User Data process
will start after 180 days following
the implementation of deletion of
the Organization and will becomplete within 10 days of start*.
The Services are terminated due
to payment delay or any otherreasons pursuant to the Article 9.1
of Nulab Terms of Service

The terminationof theOrganization will be
automatically implemented after
90 days have passed from thesuspensionof theServices. The deletion of User
Data process will start after 180
days following theimplementation of deletion of
the Organization and will becomplete within 10 days ofstart*.

Nulab AccountDeletion of Nulab AccountThe deletion of User Data
process will start upon deletionof the Nulab account and will becomplete within 10 days ofstart*.

Managed AccountDeletion of Organization orManaged AccountIn case the deletion of theOrganization is implemented;
the deletion of User Data
process will start after 180 days
following the implementation ofdeletion of the Organization andwill be complete within 10 daysof start*.
In case the deletion of theManaged Account is
implemented; the deletion ofUser Data process starts upon
the deletion and will becomplete within 10 days ofstart*.

The trial period is ended without arequest for formal paid plans

The deletion of the Organization
will be automatically
implemented after 30 days fromthe end date of the trial period.
The deletion of User Data
process will start after 180 days
following the implementation ofdeletion of the Organization and7

Nulab Security Whitepaper

will be complete within 10 daysof start*.

Audit Log

The Services are terminated due
to payment delay and any otherreasons pursuant to the Article
9.1 of Nulab Terms of Service

The deletion of the Organization
will be automatically
implemented after 90 days fromthe termination of theServices. The deletion of User
Data process will start after 180
days following theimplementation of deletion of
the Organization and will becomplete within 10 days ofstart*.

Deletion of Organization

The deletion of the audit log
process will start after 180 days
following the implementation ofdeletion of the Organization andwill be complete within 10 days
from the start*.

The contract period for Nulab
Pass has expired

The deletion of the audit log
process will start after 30 days
following the expiration of the
Nulab Pass contract and will becomplete within 10 days fromthe start*.

The trial period for Nulab Passhas ended without a request forformal paid plans

The deletion of the audit log
process will start after 30 days
following the expiration of the
Nulab Pass trial term and will becomplete within 10 days fromthe start*.

The Services are terminated due
to payment delay or any otherreasons pursuant to the Article 9.1
of Nulab Terms of Service

The deletion of the audit log
process will start after 30 days
following the expiration of the
Nulab Pass trial period and will
be complete within 10 days fromthe start*.

13 months the audit log retention
period has passed

The deletion process of the audit
log will start after 400 days
following the retention of theaudit log, and will be completed
within 10 days from the start*.

8

Nulab Security Whitepaper※ Notwithstanding the above, User Data will remain stored in the backup data collected for each service for acertain period even after the deletion completion dates listed above. For example, if the data's backups are
made once a day and retained 30 times, the data will remain stored for 30 days in the data's backups after
deletion is complete and will be deleted on the 31st day.
※ All Typetalk data, including backups, will be deleted on December 31, 2025, after the service isterminated, notwithstanding the provisions of “Conditions and timing of deletion” above.

User Data Exempted from Deletion
All User Data registered by Users for each Service shall be deleted except for the following data:
●
●
●
●
●
●

Data related to contracts, billing and deposit for each service
Administrator’s name and contact for each service
Backlog space owner’s name and contact (Classic Plan)
Backlog space ID
Nulab Pass’ Nulab Organization ID
Image inserts uploaded to Cacoo

However, in case of the deletion of the Nulab account, Managed Account or Backlog account(ClassicPlan), the User Data in Backlog, Typetalk or Cacoo (excluding Free Plan and Plus Plan prior to November
27, 2019), created through the respective accounts, will not be deleted .
In order for these User Data to be deleted, it must fall into one of the items listed above other than “Nulab
Account” or “Managed Account”.

Log Protection and Deletion
Our service outputs and stores access logs and application logs on Amazon Web Services. These logs areaccessible only by specific business personnel.
The logs are stored for a period of 545 days. We will start deleting logs after that retention period has
elapsed, and will complete the deletion within 10 days from the start.

5. Labeling Mechanisms
Our services provide various settings and functions (labeling mechanisms) to classify information. This
chapter mainly introduces functions to control account access.
For general information on functions related to the labeling mechanism, please refer to the procedure
manual for each service (10. Providing Procedures).

9

Nulab Security Whitepaper

For All Services
Teams (excluding Backlog Classic Plan)
Users can organize the Nulab accounts into teams.
●

Team List and New Team Creation (Manual)

Backlog
Projects
Users can organize the accounts into projects, set up by the User.
●●●

Add project (Manual)
Add users (Manual)
Project Settings (Manual)Team Function (Backlog Classic Plan only)
Users can set up teams and group accounts into such teams.
●

Team Settings (Manual)

Cacoo
Folders
Users can organize their canvases by folders.
●

How to share canvases, stencils, templates in a folder (Manual)

Typetalk
TopicsUsers can set up topics to discuss about a specific thema●●●

Create a topic (Manual)
Edit a topic (Manual)Archive and delete a topic (Manual)10Nulab Security Whitepaper

6. Adding and Deleting Users
For All Services (Excluding Backlog Classic)
User Registration
Customers can create a Nulab account through sign up (*1) or when they are invited to an organization.
Accounts created through sign up will be administrators and they can perform the following organization
management functions, such as “Invite to an organization” etc.
●●●●

Create a Nulab Account (Manual)Sign up for a Free trial of Backlog (Choose Plan)
Sign up for a Free trial of Cacoo (Choose Plan)
Sign up for a Free trial of Nulab Pass (Trial Page)*1
Sign up refers to the use the Services through a free trial, or to the creation of a Nulab Account from the
Sig Up option.

Delete Users
Users can always opt to delete their Nulab Account.
Only the users themselves can delete their Nulab Account.
●

Delete Nulab Account (Manual)

Invite to an Organization
Users with the authority to invite others can always invite other users to their organization.
●

Invite Users (Manual)

Remove from an Organization
Administrators can remove users from their organizations. By removing a user, such removed user will
be unable to use the services used by the organization.

11

Nulab Security Whitepaper

Backlog (Classic Plan)
Backlog (Classic Plan), can be used with a Nulab Account or by creating a Backlog-only user. Authorizedusers, within the scope of their contract plan, can add or remove users.
●

Add, Manage, Delete Users (Manual)

Nulab Pass
Through Nulab Pass, customers can create Managed accounts that are using an IdP (Identity Provider)and can be used with Single-Sign On (SSO).
The administrator can register or remove managed accounts.
Based on the selected plan, audit logs can be recorded and saved.
●
●
●
●
●

Create, Manage, Delete Managed Accounts (Manual)
Set SAML Authentication (SSO) (Manual)
Changing an account type (Manual)
Audit log settings and file (Manual)
User Provisioning (Manual)

7. Access Rights Management
For All Services (Except Backlog Classic)
Users can set the access rights of a Nulab Account or a Team within an organization.
There are 3 types of authorities: administrator, general user and guest.
Also, general users can have the additional authorization to invite members.
●●●

User Authorities (Manual)
Invite Members to an Organization (Manual)
Add Invitation Authority to General Users (Manual)

Backlog
Users can set access rights to projects and the information within the projects.
●●●●

User Authorities (Manual)Add, Manage and Delete Users (Manual)
Edit Project Participants, Project Manager Settings (Manual)Add, Change and Delete Teams (Manual)12

Nulab Security Whitepaper

Backlog (Classic Plan)
Backlog (Classic Plan) has an account and team management function.
●

Add, Manage and Delete Users (Manual)

Cacoo
Users can set authorities for the folders within an organization.
There are 3 types of authorities, “Viewer”, “Editor” and “Owner”.
The administrator of an organization can authorize certain members of the organization to use Cacoo.
●●Manage Access to Folders (Manual)Manage Active Users (Manual)

Typetalk
Depending on the organization authorities set by the user, different authorities can be set for the topics
within Typetalk.
Administrators can authorize certain members of an organization to use Typetalk and to participate in
topics.
●●●Member Authorities (Manual)Management of Topic Participants (Manual)Management of Organization Members (Manual)

Nulab Pass
Users can set up access rights to the recorded and saved audit logs.
- Audit log authorities (Manual)

8. How to Set Password
Nulab AccountInitial Password
Users can set their own password when they create their Nulab Account.

13

Nulab Security Whitepaper

How to Change Password●

Password Management (Manual)

Backlog (Classic Plan)
For Backlog (Classic Plan), a password is automatically issued when the space administrator creates a
new user.

Initial Password
When the administrator creates a new account, the initial password is generated and sent to the email
address of the new account.

How to Change Password●

Change Password(Manual)

Nulab Pass
The login ID and the password to a Nulab Pass managed account is the login ID and the password set by
the Customer on their IdP (Identity Provider).
Password information is not stored in Nulab Pass.
●

Login with SAML Authentication (SSO) (Manual)

9. Encryption
User Information●●

Each user information (such as name, email address) stored in databases are not encrypted but
access rights are appropriately limited.
Passwords are stored in an irreversible encrypted (hashed) state.

Correspondence with the Services●

Correspondence between Customer’s terminal and the services provided by us are encrypted by
SSL/TLS.

Database Encryption
14

Nulab Security Whitepaper●

Database file are encrypted for the following services.
Target service: Cacoo, Typetalk

10. Manage Changes Management to the Services
Information about service changes that affect users and maintenance that involves service outages can befound at the link below. In addition, if there is a significant impact, we will also notify you on eachservice's dashboard and via newsletters.
●
●
●
●
●
●
●
●
●

Product Updates (Japanese)
Backlog Announcements (Japanese / English)
Backlog Maintenance Information (Japanese / English)
Backlog New Release (Japanese / English)
Cacoo New Release (Japanese / English)
Typetalk New Release (Japanese / English)
Backlog Official X (Twitter) (Japanese / English)
Cacoo Official X (Twitter) (Japanese / English)
Typetalk Official X (Twitter) (Japanese / English)

11. Manuals
Various manuals for users can be accessed from the links below.
●
●
●
●
●

Nulab AppsApp User Guide (Japanese / English)
Backlog Tutorial (Japanese / English)
Cacoo Support (Japanese / English)
Typetalk Support (Japanese / English)
Nulab Pass Support (Japanese / English)

12. Backup
For all Nulab Services●●●●

Nulab is using the Snapshot function provided by AWS for the backup.
Backup data is stored in high-availability and high-durability storage in AWS.
The backup data is for the purpose of restoring the entire service, individual customer data cannot
be restored individually.
The region for the backup data is the same as the region specified in "2. Location of Data
Storage".
15

Nulab Security Whitepaper

Nulab Apps / Nulab Pass●

The scope, frequency and retention period of backups performed by Nulab are as follows.
○ Database (users, group etc): Saved once a day and retain 14 savings

Backlog●●

The scope, frequency and retention period of backups performed by Nulab are as follows.
○ Database (issues, wiki etc.): Saved once a day and retain 30 savings.
○ Shared files, Git, Subversion: Saved twice a day and retain 60 savings.
The above content is also described in our Recovery actions during server outage as well.

Cacoo
●

●

The scope, frequency and retention period of backups performed by Nulab are as follows.
○ Database (figures, templates saved by user etc) : Saved once a day and retain 14 savings..
○ Picture files used for figures: Since they are stored in highly available and highly durable
storage, it is considered that there is almost no risk of loss, so they are excluded frombackup.
The above content is described in our Security, privacy and outage policies.

Typetalk●●●

The scope, frequency and retention period of backups performed by Nulab are as follows.
○ Database (topics, messages, etc): Saved once a day and retain 14 savings.
○ Attached files: Since they are stored in highly available and highly durable storage, it isconsidered that there is almost no risk of loss, so they are excluded from backup.
The above content is described in our Security, privacy and outage policies as well.
Upon termination of service, backups will be deleted as of December 31, 2025.

13. Time zone information for logs●●

Logs within the services provided by Nulab are taken in GMT(UTC+0) or JST(UTC+9), which isthe server time.
Log times are synchronized with the NTP service provided by AWS.

14. Information for Vulnerability Management●

The services we provide are periodically assessed for vulnerabilities by a third party once a year.
We examine the contents of any identified issues and take necessary actions.

16

Nulab Security Whitepaper

●
●
●

●

The development team of our services regularly collects vulnerability information related to theOS, middleware, etc. used for the provision of the services.
If a vulnerability patch for a component used in our services is released, we will promptly apply it
according to a pre-established process.
We do not provide specific information on all publicly available software vulnerabilities,
including whether or not they are used by our company.
○ Examples: OS, middleware, libraries, firmware
If we confirm the impact of a vulnerability, we will notify the registered contact, including
whether or not we will respond to the vulnerability.

●

15. Secure Development Life Cycle●●

We check whether basic vulnerabilities have been addressed by means of mutual code reviews by
development staff and static analysis of source code.
We regularly check the libraries installed on servers or embedded in services for out-of-dateversions, vulnerabilities discovered, etc. When a software lifecycle ends or a service is affectedby a vulnerability, we take the appropriate action, such as updating the library group.

17

Nulab Security Whitepaper

16. Incident Response●●

In the event a security incident (as defined by us) occurs, that affects users or that we believe may
affect users, we will contact the user's administrator by e-mail or by one or more other means
based on our choice within 72 hours.
For inquiries relating to information security incidents reach us from the inquiry page below.
○ Inquiry Page: https://nulab.com/contact/

17. Protection and Third Party Provision of User Data●●●

It is our responsibility to protect the data entrusted to us by the users.
User data, including log data, is stored under access rights that are set so that only a limited
number of people in each service development team can access it, in order to prevent
unauthorized access and falsification.
However, if we are legally obligated to provide user data, in a legally recognized form, such as byan order from a competent court to submit as evidence, Nulab will provide such user data without
the user's permission, to the minimum extent necessary.

18. Governing Law●

The agreement between us and the users is governed by the laws of Japan.

18

Nulab Security Whitepaper

19. Authentication●●

We have acquired ISMS certification in the ISMS conformity assessment system operated by the
Information Management System Accreditation Center (ISMS-AC). (*1)
We have acquired ISMS cloud security certification in the ISMS conformity assessment system
operated by the Information Management System Accreditation Center (ISMS-AC). (*2)

【Scope of ISMS Cloud Security Certification Registration】
Service Provider for the cloud services of Backlog, Cacoo, Typetalk, Nulab Apps for systemdevelopment, operation and maintenance, and ISMS cloud security management system for use as a cloudservice customer for Amazon Web Services.
*1 https://isms.jp/lst/ind/CR_IS_x0020_656556.html*2 https://isms.jp/isms-cls/lst/ind/CR_CLOUD_x0020_681700.html

20. Use of Third-Party Service Providers
The Services provided by Nulab use the following external cloud services for the provision of the listedfunctionalities. The content of this Security White Paper does not extend to the scope managed by thecloud services shown below, and we do not guarantee compliance with the content to that extent.

Cloud Service

Function

ProviderAmazon Web Service

Infrastructure
Construction andOperation

Amazon Web Services, Inc.

Google Cloud

Infrastructure
Construction andOperation

Google LLC

PagerDuty

Infrastructure Operation

PagerDuty, Inc.

mackerelInfrastructure Operation

KK. Hatena

Intercom

Customer Support

Intercom, Inc.

Google Workspace

Customer Support

Google LLC

Zendesk

Customer Support

Zendesk, Inc.

StripePayment

Stripe, Inc.

19

Nulab Security Whitepaper

PayPalPayment

PayPal Holdings Inc.

TwilioSMS Transmission

Twilio Inc.

Mixpanel

Data Analysis

Mixpanel, Inc.

Mailchimp

Email Transmission

Intuit Inc.

SendGrid

Email Transmission

SendGrid, Inc.

Marketo

Email Transmission

Adobe Inc.

Salesforce

Customer Management

Salesforce, Inc.

Slack

Service Operation,
Customer Support

Slack Technologies, LLC

Snowflake

Data Analysis

Snowflake Inc.

20

Nulab Security Whitepaper

Revision History
VersionDate of Revision

Content of Revision

1.0

25 Feb 2019

Original Version Issued

1.1

14 Jun 2019

11.Change of Backup Conditions for Backlog
19.Changes to services subject to exemption

1.2

9 Oct 2019

3. Change in data deletion

1.3

6 Dec 201919.Changes to services subject to deletion

1.4

19 Jul 2021

1. Separation of Responsibilities
2.Change of Data Storage Location
3. Change to data deletion
4. Labeling Function
5. User Registration and deletion
6. Access Rights Management
7. Password Distribution Method
10. Change of Manual
11.Change of Backup Conditions
15. Change to Incident Measures
19. Changes to services subject to exemption

1.5

24 Dec 2021

Changes relating to the addition of Nulab Pass’s Audit log function
2. Change of Data Storage Location
3. Data Deletion
5. User Registration and deletion
6. Access Rights Management

1.6

26 Sep 2022

2. Modified the description of data storage location
3. Modified the description of target services for data deletion
11. Changed backup description in Cacoo part
19. Revised the heading and updated the target services

1.7

18 May 2023

5. User Registration and deletion - Change the manual
8. Encryption -Change the User Information
8. Encryption - Add the Database Encryption
11. Backup - Change the For all Nulab Services

1.8

1 Dec 2023

13. Information for Vulnerability Management - Change thevulnerability assessment

2.0

18 Sep 2024

Updated content following revised terms of service

21