SECURITY & DATA

Information Security & Data Handling

In providing our AI sales agent "MAILGORI," CosmoSketch Inc. implements the following measures to protect the data we are entrusted with by our customers.

1. Basic Policy

We operate on the principles of keeping customer data separate from that of other companies, handling it to the minimum extent necessary, and incorporating human review. Outreach and initial replies follow the policy agreed with the customer.

2. Safety Management Measures We Implement

Technical measures: encryption of data in transit and at rest, encrypted storage of authentication credentials (secrets), access control and the principle of least privilege, and data separation for each tenant (customer).
Operational measures: audit logging of all sending actions, usage limit management (to prevent runaway costs), setup review of message samples and policies, and optional prospect or message review when requested.
Organizational measures: limiting who handles data, and strict confidentiality.

3. Handling of AI

External AI (large language models, etc.) is operated under conditions where input data is not used to train that provider's models.
We do not repurpose the data entrusted to us by customers for training our general-purpose models or for use on behalf of other customers.
During requirements definition, the customer reviews sample messages by scenario and agrees the outreach and reply policies. Per-message approval is not required; prospect or message review can be enabled when requested. The AI sales agent prepares replies within the agreed policy and can guide prospects to a scheduling link. When no scheduling link is used, the customer handles meeting coordination, technical questions and quotations. CosmoSketch intervenes if quality declines or an anomaly occurs.

4. Data Location & Subcontracting

This service is operated on the cloud managed by our company. To the extent necessary to provide the service, we may subcontract processing to external cloud, delivery, and AI providers, and we exercise appropriate oversight of subcontractors through contracts and other means.

5. Data Return & Deletion

Upon termination of the contract, we will, in accordance with the contract terms, support the export, return, and deletion of customer data.

6. Incident Response

In the unlikely event that there is a risk of information leakage or similar, we will promptly work to confirm the scope of impact, report to affected customers, and prevent recurrence, and we will take the necessary actions in accordance with applicable laws and regulations.

7. Status of Third-Party Certifications

At present, our company has not obtained third-party certifications such as ISO/IEC 27001 (ISMS) or the Privacy Mark. We update this page when our certification status changes.

8. Contact

For questions regarding security and data handling, please use our contact form. Before contracting, we can explain the external services used, access permissions, and data retention and deletion conditions for your engagement.

Last updated: October 16, 2026