Blue One Security
Blue One is an AI document translation service. We disclose our policies for handling customer data and operations. We also respond to individual security questionnaires.
Data Blue One handles
- Uploaded source files (PDF / PPTX / DOCX / XLSX / text)
- Translation output
- Customer-registered glossaries and dictionaries
- Translation history
- Account information (email address, organisation name, credentials)
Certification status
We use Google Cloud Platform (ISO27001 / SOC2 certified).
Yellow Blue Inc. is certified by GCERTI to ISO/IEC 27001:2022 (ISMS).
- Standard
- ISO/IEC 27001:2022
- Certificate No.
- GIJP-2266-IC
- Certification body
- GCERTI-JAPAN Co., Ltd.
- Accreditation body
- IAS (USA, MSCB-113)
External services that receive data outside Japan are covered by our ISMS supplier management: we verify their certification status (ISO27001 / SOC2 and equivalents) and monitor it annually.
Where data is stored
Customer data is operated on Google Cloud Platform in the Japan region. Processing passes through external services outside Japan (generative AI, file conversion and the like) only while a translation is running; uploaded files and translation results are stored in Japan.
Retention and deletion
- On the Free plan, files are automatically deleted 1 day after translation completes
- On paid plans, the retention period is configurable (choose from Immediately / 1 day / 7 days / Never)
- The periods above apply to the servers we manage
Encryption
- At rest: AES-256 encryption
- In transit: TLS encryption
Translation processing (AI model usage)
Blue One's translation processing uses external generative AI services. We use each of these services only where the provider guarantees, under our contract or the provider's own terms, that input data will not be used to train AI models. Processing passes through external services outside Japan (generative AI, file conversion and the like) only while a translation is running, and the uploaded files and translation results we store are held on servers in Japan that we manage. External services may retain transmitted data for up to 30 days for purposes such as abuse detection, and it is deleted after that period, except where retention is required by law or where an external service is investigating suspected abuse.
AI training / secondary use policy
We do not use customer data for AI model training. Our terms of service commit us to never using customer data for training, and on top of that, our contracts with each external generative AI provider, or the terms set by those providers, prohibit such training use as well.
Internal access policy
- Blue One employees do not normally view customer translation files or account information
- Only when legitimately required — such as a customer request or incident response — may we temporarily review data, and only through an approval workflow
- Temporary production access is managed via an approval workflow
- Internal permissions are granted and revoked under managed policy
Security checksheet support
We respond to individual security checksheets from IT / security teams. NDAs are handled case by case.
Contact: blue1_support@yellowblue1.comFrequently asked questions
▶Is translation data used for AI training?
No. Our terms of service commit us to never using customer data for training, and on top of that, our contracts with each external generative AI provider, or the terms set by those providers, prohibit such training use as well.
▶Where is the data stored?
It is stored on Google Cloud Platform in the Japan region. Processing passes through external services outside Japan (generative AI, file conversion and the like) only while a translation is running; uploaded files and translation results are stored in Japan.
▶When are translation files deleted?
On the Free plan, files are automatically deleted 1 day after translation completes. On paid plans, the retention period is configurable (choose from Immediately / 1 day / 7 days / Never).
▶Can Blue One employees view customer files?
Normally, Blue One employees do not view customer files. Only when legitimately required — such as a customer request or incident response — may we temporarily review them, and only through an approval workflow.
▶Is data encrypted in transit and at rest?
In transit via TLS; at rest via AES-256.
▶Has Blue One obtained ISMS certification?
Yes. We are certified to ISO/IEC 27001:2022 (Certificate No. GIJP-2266-IC). Blue One is built on Google Cloud Platform (ISO27001 / SOC2 certified).
▶Can you respond to security checksheets?
Yes. Please contact blue1_support@yellowblue1.com.
Contact
- Contact us about security: blue1_support@yellowblue1.com
- Contact us for Enterprise