Thank you for your question.
Yes, that understanding is correct. Since we are entrusted with our members’ important information, we take every possible precaution to protect it.
To be completely honest, no company can guarantee that information will “never leak,” no matter how many safeguards it has in place. Universe is no exception.
That is why we take the following measures:
・We have obtained the JAPHIC Mark, a third-party certification for personal information protection, and undergo reviews by an external organization
・All communications are encrypted
・Access to our internal systems is restricted according to each employee’s role, and two-factor authentication is required to log in. Access for departing employees is revoked immediately
・All entries to and exits from our offices are recorded, and access to areas where personal information is handled is restricted
・Documents and computers are disposed of after being rendered unrecoverable by a specialist disposal company
・We carry insurance covering cyberattacks and information leaks, in case of an incident
・If anything were to happen, we would promptly notify our members and make a public announcement
However, we do not disclose technical details such as our server configurations. This is not because we want to hide them. Publishing such information would essentially give attackers a map showing them where to target, which could actually put our members’ information at greater risk.
Our club has always operated on the policy of not concealing inconvenient information. We publicly report system failures when they occur, and we also disclose our service status.
・Details of our security measures: https://universe-club.jp/aboutus/universe-protection/
・Service status: https://status.unv.group/
If there’s anything you’re concerned about, please feel free to ask.
This may sound like a somewhat rigid, by-the-book answer, but when we can’t discuss too many technical details, this is probably about as much as we can say.
By the way, to share a little more about how things work internally:
Several years ago, Universe Club decided to store personal information only in a separate cloud system, rather than keeping it on members’ account pages.
Our policy is not to store personal information in Universe’s own system because it is impossible to prevent every possible attack.
Of course, if the cloud system itself were targeted, there would be little we could do. In that sense, you could say our view is that this would be an issue with the cloud provider, rather than with Universe.
Some people may consider that a little unfair, but for a small company looking to achieve the strongest possible defense, it seems highly rational to store the data in a system protected by a large team of highly capable specialists and leave the security to them.
Even with security measures in place, there’s little you can do if you’re specifically targeted.
That said, attackers generally go after major or important organizations that would make the news, so it’s unlikely that Universe Club would be targeted.
I’m not an expert, so I can’t speak in detail, but one thing I make a point of in my own company—or rather, my business—is keeping things off the internet as much as possible.
In particular, computers containing customers’ personal information are never connected to the internet. That means the OS doesn’t get updated and the computers are somewhat slow, but they’re perfectly adequate for storing and retrieving data. These days, I think we put far too much online. The cloud is out of the question.
I also think we collect more personal information than necessary. Take members’ dates of birth, for example. Do we really need the month and day? The year alone should be enough, shouldn’t it? The automatic age updates might be off by a few months, but that wouldn’t cause any real problems.
For identity verification, things like driver’s licenses and My Number cards don’t need to be copied just because multiple staff members verified them. If copies really are necessary, they should be physical copies stored in locked drawers at each branch. Above all, the information shouldn’t be retained electronically.
As for the email address used to log in to the site, members shouldn’t have to use their private email addresses. Uniba could prepare and distribute email addresses for them, along with the passwords. Everything could be provided by Uniba. The key is to avoid using members’ personal information as much as possible.
A lot of people reuse the same password, so Uniba could distribute passwords that members aren’t allowed to change, and then update them periodically. The password could even be the same for every member, couldn’t it?
Rather than trying to strengthen security and fight online, I think the right approach going forward is to get away from the internet and take refuge offline.
