Security and Data

This page includes what we do not have. A trust page that only lists strengths tells you nothing, because every vendor's list looks the same.

If something below is a blocker for you, it is better that you find out now.

Where your data lives

Region     AWS ap-northeast-1 (Tokyo)
Database   MySQL 8.0 on Amazon RDS
Delivery   Amazon CloudFront
Transport  TLS on every connection

All data is stored in Tokyo. There is no other region. If your jurisdiction requires data to remain within a specific country or economic area, tasteck does not meet that requirement today, and we would rather say so than discover it in week three of your trial.

⚠️ For EU buyers specifically: Japan holds an adequacy decision from the European Commission, which is the mechanism that permits EU personal data to be transferred to Japan. Whether that is sufficient for your particular obligations is a question for your own counsel, not something we can determine for you.

Backups and recovery

Automated backups   daily, retained 7 days
Point-in-time       available within the retention window
Multi-AZ            not enabled
Cross-region replica not configured

The last two lines are the honest ones. Our database instances run in a single availability zone with no cross-region replica. This means an availability-zone failure is a recovery-from-backup event, not an automatic failover.

We do not publish an uptime percentage, because we do not run external uptime monitoring that would let us stand behind one. A number we cannot evidence is worse than no number.

Access control

Role-based access separated by surface — staff console, and the three mobile apps
Staff entertainers, drivers and guests cannot reach the management console at all
Per-company staff permissions (create / view / delete bookings, and so on)
Passwords hashed with bcrypt
Password reset by emailed token
API access logged

Leavers are disabled from the console, immediately, by your own administrator. There is no automatic dormancy lockout — if someone leaves, someone has to switch them off. Build that into your offboarding.

Multi-company separation

If you run several venues under one account, each company's data is separated at the permission layer, and staff permissions are set per company rather than globally.

This applies to the ChatGPT integration too: a token is scoped to the companies your account already has, and the scoping is enforced server-side, not by the language model. See Connect tasteck to ChatGPT.

Getting your data out

Export        all data as CSV or JSON, from the console
After cancel  retained 30 days (so an accidental cancellation is recoverable), then deleted
Lock-in       none. Cancel from the console at any time, no minimum term

Test the export during your trial, not at the end of your contract. This is good advice about any vendor, us included.

Support

Email        Japanese, weekdays 10:00-18:00 JST, normally answered within 24 hours
English      available for onboarding, integration and technical questions
In-product   AI support from the Light plan upward
Urgent       info@tasteck.tech

Be realistic about the time zone. If you operate in the Americas or Europe, our staffed hours will not overlap your night. The in-product AI support does not have that limitation, and most operational questions are answerable there.

Compliance position

Privacy policy   published, aligned with Japan's personal information protection law
Terms           exclude organised crime affiliation; declared at sign-up
Minors          prohibited from use and registration by contract
Review cycle    terms and privacy policy reviewed at least annually
Pricing changes at least 30 days' notice to existing customers

What we do not hold today: we are not SOC 2 audited and not ISO 27001 certified, and we hold no HIPAA or PCI attestation. We do not store card numbers — payments run through Stripe, and card details never reach our database.

If your procurement requires a certificate on file, we do not have one to send you. That is a real answer rather than a "contact us." Chain-scale engagements include a security review conducted against your criteria, which is a different thing from holding a certification — ask us which one you actually need before you start the process.

What we would tell a careful buyer

Run the export during your trial. Confirm the file contains what you need.
Ask your counsel about Japan data residency if you are in a regulated jurisdiction.
Plan your offboarding process, because dormant accounts are not disabled for you.
Assume support overlap is limited if you are far from JST, and lean on the ChatGPT integration.
If you need SOC 2, stop here. We will not waste your time.