So that you can use Dive with confidence, we implement security measures and operations from many angles to protect your important data.
Compliance with international information security standards
We obtained ISO/IEC 27001:2022, the international standard for information security (Information Security Management System: ISMS), in November 2024. Third parties have confirmed that our organizational structure and the security level of our services are maintained.
Security assessment platform
We have submitted our responses to an external security assessment platform (Assured). Against an overall average score of 76.7 points, we received a rating of 93.2 points, which places us in the top 25%.
You can also obtain the results through Assured. Please make use of them.
<What is Assured>
- Assured is a third-party cloud service assessment platform (https://assured.jp/).
- It is a third-party cloud security assessment body certified as conforming to the Ministry of Economy, Trade and Industry (METI) “Information Security Service Standard.”
- This information is an evaluation of third-party survey responses, conducted based on international frameworks such as ISO27001 and NIST SP800-53 and major domestic guidelines such as those issued by METI, the Ministry of Internal Affairs and Communications (MIC), and FICS.
Security checklist
We provide a security checklist that complies with the “Cloud Service Level Checklist” published by the Ministry of Economy, Trade and Industry (METI). Please use it to confirm whether it meets your company's security standards.
METI “Cloud Service Level” checklist (PDF)
Extensive track record of deployments
Dive is used by many organizations that require strict security, including listed companies and universities.
IHI Group (IHI Transport Machinery), DENSO, Kaneka, Nippon Steel Group (Nippon Steel Environment & Energy Solutions), JAL Group (JAL Grand Service), Unitika, SG Holdings (Sagawa Global Logistics), Actio, Sotetsu Holdings (Sotetsu Kigyo), National Center for Global Health and Medicine, Tokyo University of Technology, Saga University, etc.
Single Sign-On (SSO)
Single Sign-On is supported through integration with SAML 2.0 and Microsoft Entra ID (OIDC).
IT administrators can manage member accounts centrally, which reduces the risk of IDs and passwords being leaked and helps keep information more secure.
HR roster sync (SCIM)
The roster can be synced automatically with HR systems such as Microsoft Entra ID and Okta (SCIM 2.0). Accounts are created, updated, and disabled automatically as people join, transfer, or leave, which prevents forgetting to disable the accounts of people who have left (Enterprise plan. Automatically sync the roster from your HR system (SCIM)).
Two-factor authentication (2FA)
Two-factor authentication (2FA) is a mechanism that verifies a person's identity at login using two methods. In addition to the usual password authentication, one more separate authentication step makes the account more secure. Dive supports TOTP (Time-based One-Time Password). To use this feature, use a common authentication app such as Google Authenticator, Microsoft Authenticator, etc.
In the administrator settings, you can also make two-factor authentication mandatory for all users.
Encryption of communications and data
All communications are encrypted with HTTPS.
Third parties cannot eavesdrop on the content.
In addition, both databases and files are encrypted.
Highly reliable data centers
Dive uses data centers on Google Cloud Platform (GCP). GCP offers very high reliability, security, and a proven track record. The storage region is in Japan (Tokyo). When delivering videos and images, traffic may pass through Google's edge network to improve playback stability, and content may be temporarily cached at the edge in the region where it is viewed. The storage location stays in the Tokyo region.
About security on Google Cloud
Video analysis AI designed not to retrain on your data
With general AI chat services (such as ChatGPT), data entered by users may be used for additional training of the model.
Dive's video analysis AI runs Google Cloud Vertex AI (Gemini) within a GCP project managed by our company. Under the Google Cloud agreement, we have adopted a mechanism so that your data is not used to retrain AI.
The design lets you confidently submit highly confidential know-how, such as work procedures, to AI analysis.
Reliable data backup
All data is backed up regularly. Even if a failure or other incident causes data loss, we maintain a system that allows the data to be restored.
Access log (audit log)
Users with the Owner role can obtain access logs within the team.
Access logs include “Log in history” and “User and Group change history,” among others.
<System logs collected on our operations side>
GCP logs, OS logs, middleware logs, and application logs
Strict data management
Server monitoring runs 24 hours a day, 365 days a year. Access to servers is limited to a restricted group of system operations staff. In principle, operations staff do not view your data. (Except when unavoidable, such as at your request or for failure response.)
IP address restriction
You can set access permissions for specific IP addresses. You can operate it in line with your security policy, such as blocking access from outside your company's offices.
Flexible access control
Flexible permission settings are available to match your organization's size. You can set access permissions for information in detail for each user, enabling more secure information sharing.