WORKS MOBILE Corporation
System and Organization Controls 3 Report
On Controls Relevant to Security, Availability, Processing Integrity,
Confidentiality, and Privacy of LINE WORKS ServiceJanuary 1, 2021 – December 31, 2021

This report is an English translation of the original report and is intended for LINE WORKS service in Japan and NAVER WORKS service in Korea.

Table of contents
Section I: Independent Service Auditor’s Report ........................................................... 2
Section II: Management’s Assertion ............................................................................... 4
Section III: Description of the Boundaries of LINE WORKS Service System ................... 5
1. Overview of Operations ............................................................................................. 5
Company Introduction ........................................................................................... 5Service................................................................................................................... 5
Report Scope Boundary ......................................................................................... 5
2. Service Components.................................................................................................. 6
Infrastructure ........................................................................................................ 6
Software ................................................................................................................ 6
Human Resources.................................................................................................. 6
Procedures ............................................................................................................ 6
Data ...................................................................................................................... 7
Section IV: Principal Service Commitments and System Requirements ....................... 8

Deloitte Anjin LLC

9F., One IFC,
10, Gukjegeumyung-ro,Youngdeungpo-gu, Seoul
07326, Korea
Tel: +82 (2) 6676 1000
Fax: +82 (2) 6674 2114
www.deloitteanjin.co.kr

Section I: Independent Service Auditor’s Report

WORKS MOBILE Corporation
10F KRAFTON Tower, 117, Bundangnaegok-ro,
Bundang-gu, Seongnam-si,Gyeonggi-do, Korea

Scope
We have examined WORKS MOBILE Corporation (‘WORKS MOBILE’, or the ‘service organization’)’s
accompanying assertion titled "Section II: Management’s Assertion" (‘assertion’) that the controls within
the LINE WORKS Service system (‘system’) were effective throughout the period January 1, 2021 toDecember 31, 2021, to provide reasonable assurance that WORKS MOBILE’s service commitments andsystem requirements were achieved based on the trust services criteria relevant to security, availability,processing integrity, confidentiality, and privacy (‘applicable trust services criteria’) set forth in TSP Section
100, 2017 Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, andPrivacy (AICPA, Trust Services Criteria).

Service Organization’s Responsibilities
WORKS MOBILE is responsible for its service commitments and system requirements and for designing,implementing, and operating effective controls within the system to provide reasonable assurance that
WORKS MOBILE’s service commitments and system requirements were achieved. WORKS MOBILE has
also provided the accompanying assertion about the effectiveness of controls within the system. When
preparing its assertion, WORKS MOBILE is responsible for selecting, and identifying in its assertion, theapplicable trust services criteria and for having a reasonable basis for its assertion by performing anassessment of the effectiveness of the controls within the system.

Service Auditor’s ResponsibilitiesOur responsibility is to express an opinion, based on our examination, on whether management’sassertion that controls within the system were effective throughout the period to provide reasonableassurance that the service organization’s service commitments and system requirements were achieved
based on the applicable trust services criteria. Our examination was conducted in accordance withattestation standards established by the American Institute of Certified Public Accountants (AICPA) andInternational Standard on Assurance Engagements 3000, Assurance Engagements Other Than Audits orReviews of Historical Financial Information, issued by the International Auditing and Assurance Standards
Board (IAASB). Those standards require that we plan and perform our examination to obtain reasonableassurance about whether management’s assertion is fairly stated, in all material respects. We believe thatthe evidence we obtained is sufficient and appropriate to provide a reasonable basis for our opinion.
Our examination included:•Obtaining an understanding of the system and the service organization’s service commitments
and system requirements
2•Assessing the risks that controls were not effective to achieve WORKS MOBILE’s service
commitments and system requirements based on the applicable trust services criteria•Performing procedures to obtain evidence about whether controls within the system wereeffective to achieve WORKS MOBILE’s commitments and system requirements based on theapplicable trust services criteria

Our examination also included performing such other procedures as we considered necessary in thecircumstances.

Inherent limitations
There are inherent limitations in the effectiveness of any system of internal control, including thepossibility of human error and the circumvention of controls.
Because of their nature, controls may not always operate effectively to provide reasonable assurance thatthe service organization’s service commitments and system requirements were achieved based on theapplicable trust services criteria. Also, the projection to the future of any conclusions about theeffectiveness of controls is subject to the risk that controls may become inadequate because of changes
in conditions or that the degree of compliance with policies or procedures may deteriorate.

OpinionIn our opinion, management’s assertion that the controls within WORKS MOBILE’s LINE WORKS Service
system were effective throughout the period January 1, 2021 to December 31, 2021, to provide reasonableassurance that WORKS MOBILE’s service commitments and system requirements were achieved based on
the applicable trust services criteria is fairly stated, in all material respects.

March 25, 2022
Seoul, Republic of Korea

3Section II: Management’s Assertion
We are responsible for designing, implementing, operating, and maintaining effective controls within
WORKS MOBILE Corporation (‘WORKS MOBILE’)’s LINE WORKS Service system (‘system’) throughout theperiod January 1, 2021 to December 31, 2021, to provide reasonable assurance that WORKS MOBILE’sservice commitments and system requirements relevant to security, availability, processing integrity,confidentiality, and privacy were achieved. Our description of the boundaries of the system is presented
in Section III and identifies the aspects of the system covered by our assertion.
We have performed an evaluation of the effectiveness of the controls within the system throughout theperiod January 1, 2021 to December 31, 2021, to provide reasonable assurance that WORKS MOBILE’sservice commitments and system requirements were achieved based on the trust services criteria relevant
to security, availability, processing integrity, confidentiality, and privacy (‘applicable trust services criteria’)set forth in TSP section 100, 2017 Trust Services Criteria for Security, Availability, Processing Integrity,Confidentiality, and Privacy (AICPA, Trust Services Criteria). WORKS MOBILE’s objectives for the system inapplying the applicable trust services criteria are embodied in its service commitments and system
requirements relevant to the applicable trust services criteria. The principal service commitments andsystem requirements related to the applicable trust services criteria are presented in Section IV.
There are inherent limitations in any system of internal control, including the possibility of human error
and the circumvention of controls. Because of these inherent limitations, a service organization may
achieve reasonable, but not absolute, assurance that its service commitments and system requirements
are achieved.
We assert that the controls within the system were effective throughout the period January 1, 2021 toDecember 31, 2021, to provide reasonable assurance that WORKS MOBILE’s service commitments andsystem requirements were achieved based on the applicable trust services criteria.

4Section III: Description of the Boundaries of LINE
WORKS Service System
1. Overview of Operations
Company Introduction
WORKS MOBILE Corporation (‘WORKS MOBILE’ or the ‘Company’) split from NAVER Corporation in April
2015 to enter the global enterprise service market, and established WORKS MOBILE Japan Corporation
targeting Japanese market in June 2015 and started providing WORKS MOBILE services (now LINE WORKS)
in January 2016.
The key status of WORKS MOBILE Japan Corporation is as follows.
COMPANY

WORKS MOBILE Japan Corporation

FOUNDEDJune 3, 2015

CAPITAL5,520 Million JPY

C.E.OFukuyama Kosuke

HEADQUARTERS

Jingumae Tower Building 11F, 1-5-8 Jingumae, Shibuya-ku, Tokyo, 150-0001

Reported
Telecommunication
Business Operator

A-27-14402

LINE WORKS service is a cloud (Saas) based communication/collaboration service that consists of variousfeatures such as messenger, voice/video call, mail, calendar, bulletin board, address book, cloud storage,
monitoring, and so on. LINE WORKS service is accessible from various types of devices like PCs,
smartphones, and tablet PCs and enables efficient communication between companies and organizations
regardless of location. In addition, LINE WORKS service provides administrators with functions such as
member management, security configuration, service statistics, auditing, and monitoring.

ServiceWORKS MOBILE provides services through PC web and mobile for the users convenience. To deliver suchservices, WORKS MOBILE uses various IT systems, security devices, and internally developed service
management systems. The system description covers LINE WORKS.
LINE WORKS – Provides cooperation/communication services such as enterprise-wide instant messenger,e-mail, drive, calendar and contact list for the employees within corporates. Also provides administrative
services such as security configuration, service statistics, auditing functions, and e-mail monitoring
systems for the management personnel.
User entities of the service are responsible to adhere to the user’s obligation in the Terms of Service inorder to securely and properly use the WORKS MOBILE services. User entities should also understand andperform the activities to protect personal information by themselves, including changing passwords on aregular basis and not disclosing passwords to others.

Report Scope Boundary
The objective and scope of this description is limited to the LINE WORKS service and does not include any
description related to other services.
5

2. Service Components
The Company’s service components to provide the service consist of infrastructure, software, data, andrelevant operating procedures and human resources.

Infrastructure
The Company implements and operates infrastructures such as servers, network, and security systems,
which are configured in a separate network for each, to provide the service. The Company restricts
unauthorized access (physical / logical) using access controls to infrastructure, and monitors the log ofabnormal activities on a regular basis.
The Company also uses automatic vulnerability scanning tools to consistently detect and improve security
vulnerabilities which may occur within the infrastructure, and takes remedial actions for identified
vulnerabilities. The data center, where the infrastructures are located, is equipped with thermo-hygrostats,
Uninterruptible Power Supplies (UPS), water leakage detectors, fire detectors, extinguishers, and so on to
get prepared for disasters such as fire, earthquake, flood, and so on.

SoftwareRelevant functions of the Company for each service are responsible for developing and operating
applications. When an application needs additional developments or upgrades to improve service qualityprovided to users, to remediate failures or to enhance system performance, the security requirements
are defined by an agreement between the Service Planning Department and the Development
Department and then shared with stakeholders via intranet.
Changes to an application requires preapproval by the person in charge, and the QA (Quality Assurance)
team reviews and deploys to the production environment through the automated system to minimize thefailures that may arise from the change. When significant changes related to the user’s personal
information processing are involved, a privacy impact assessment is conducted and remedial actions aretaken when deemed necessary.

Human Resources
To ensure service stability, the Company defines and designates such roles as information security andpersonal information managers, service planners, developers, infrastructure operators, CS (CustomerSatisfaction) personnel, and so on. Annual information security and personal information protection
trainings are provided to raise the awareness level of information security of the company personnel.
Immediately after being hired or terminated, an employee is informed of his or her confidentiality
obligations, and required to sign and submit a security pledge. All employees sign and submit a security
pledge every year.

Procedures
The Company established information security regulations such as policies, standards and guidelines tocomply with the security, availability, process integrity, confidentiality, and privacy principles. Company
policies are periodically reviewed, and revised when deemed necessary, to reflect developments ofrelevant laws and regulations. Revisions require approval by an appropriate level of management and areannounced to all employees through intranet.
Company policies related to protection of user's personal information and privacy are disclosed in thePrivacy Policy on the Company’s website so that users can refer to at any time.
6DataImportant data including user's personal information are protected in accordance with the requirementsby relevant laws and regulations such as the Act on Promotion of Information and Communications
Network Utilization and information Protection, etc., the Personal Information Protection Act, and so on
and the procedures specified in the Terms of Service and security policies of the Company. Such data aremanaged to be processed only by a limited number of personnel performing relevant duties.
The Company also implements technical measures such as access control, encryption and logging toprotect important data.

7Section IV: Principal Service Commitments andSystem Requirements
The Company has made service commitments to the user entities and established system requirements
for the LINE WORKS service. Some of these commitments are related to the performance of the service
and applicable trust services criteria. The Company is responsible for its service commitments and system
requirements and for designing, implementing, and operating effective controls within the system toprovide reasonable assurance that the Company’s service commitments and system requirements areachieved.
Service commitments to users are documented in such forms as Terms of Service, Privacy Policy, YouthProtection Policy, Spam Mail Policy, Search Result Collection Policy, and so on, and communicated to users
through the Customer Center. The Company also provides the description of the service offering throughonline. Service commitments include, but are not limited to, the following:•Security: The Company made commitments related to protecting user data from unauthorizedaccess and use. These commitments are addressed through measures including data encryption,authentication mechanisms, access controls, physical security, and other relevant securitycontrols.

•Availability: The Company made commitments related to keeping service continuity withoutdisruptions. These commitments are addressed through measures including performancemonitoring, regular data backups and recovery controls.

•Processing Integrity: The Company made commitments related to processing user data
completely, accurately and timely. These commitments are addressed through measures
including secured system development and production environments, approval of systemchanges and other relevant controls.

•Confidentiality: The Company made commitments related to maintaining the confidentiality ofuser data. These are addressed through security controls including encryption mechanisms intransferring and storing users’ important data.

•Privacy: The Company made commitments related to protecting personal information. Thesecommitments are addressed through controls relating to collecting, storing, using, entrusting,and disposing of personal information in accordance with relevant laws and regulations and its
Privacy Policy.

The Company has established operational requirements that support the achievement of service
commitments, requirements by relevant laws and regulations, and other system requirements. Suchrequirements are specified in the Company’s policies and procedures and system design documentationand communicated to users through the service website.
Information security policies of the Company define an organization-wide approach to how systems anddata are protected. These include policies over service design and development, system operation,internal business system and network management, and hiring and training of executives and employees.
In addition to these policies, standard operating procedures have been documented on how to carry out
manual and automated processes specifically required in the operation and development of the LINE
WORKS service.

8