// SECURITY & AI
Your data protected. Your AI transparent.
Security isn't an add-on. It's how we build everything.
AI Lab Global builds AI-powered apps, websites and automated customer service for businesses and freelancers in Japan. Every project, ours or our clients', follows the AI Lab Standard: an internal set of security, privacy and AI-use rules.
// 01 — WHAT WE BUILD ON
- Japan's Act on the Protection of Personal Information (APPI).
- The Japanese government's AI Guidelines for Business (METI/MIC, version 1.2).
- As technical references: the NIST AI Risk Management Framework and the OWASP Top 10 for LLM applications.
We are not ISO-certified. We use these references to guide our practices, and we show how.
// 02 — OUR COMMITMENTS
Your data never trains AI.
No client data is used to train AI models.
My Number is never stored.
If it appears in a document, it is automatically removed before anything is saved.
Every client isolated.
One client's data is never accessible to another.
Protected access.
Every admin account uses two-step verification.
A deadline for everything.
Each type of data has a set deletion period. Document photos are deleted within 7 days.
You stay in control.
Requests to access, correct or delete data are answered within 14 days.
// 03 — HOW WE USE AI
- The assistant identifies itself as automated in its first message and always offers contact with a person.
- Without human confirmation, the AI never makes payments, cancels contracts, sends documents to third parties or deletes data.
- On taxes, visas, health or contracts, answers are general guidance and point to the relevant office or a professional.
- Every change to an assistant is tested before it goes live.
// 04 — WHERE THE DATA LIVES
We only work with approved providers, under contract:
Anthropic (Claude)
- Role
- Artificial intelligence
- Country
- USA
OpenAI (Whisper)
- Role
- Audio transcription
- Country
- USA
Supabase
- Role
- Database
- Country
- Set per project
Lovable
- Role
- Development and hosting
- Country
- Set per project
n8n
- Role
- Automation
- Country
- Germany (EU)
Meta (WhatsApp Business)
- Role
- Messaging channel
- Country
- USA
Stripe
- Role
- Payments
- Country
- USA
Resend
- Role
- Email delivery
- Country
- USA
Cloudflare
- Role
- Domains and network
- Country
- Global
// 05 — FOR BUSINESS CLIENTS
Before connecting your WhatsApp or business data, we sign a data processing agreement (覚書, oboegaki) covering purpose, security, subprocessors, deletion period, and incident notice within 72 hours.
// 06 — INCIDENTS AND CONTACT
If anything happens to your data, we notify you and, where the law requires, Japan's Personal Information Protection Commission. For questions, data requests, or our full security documentation, contact us on WhatsApp or LINE.
Last updated: October 7, 2026.