Security & privacy

Development process

• System security reviews with threat modelling
• Data privacy reviews
• Quality assurance reviews
• Sony security experts

Activities

• Penetration testing of software and hardware *
• Continuous monitoring of system with alarms
• Scheduled vulnerability scanning *

Amazon Web Services

• Multi factor authentication login
• Audit trail
• Principle of least privilege

Incident Management

• Proven Sony process

* Performed by external security company and Sony

Personal data

• Personal data encrypted at rest
• HTTPS is used everywhere
• Certificate pinning from apps to cloud

Personal data handling process

• Personal data has an owner
• Process to grant access to data for development

GDPR compliance

• Terms of usage and privacy policy
• Data retention limits
• Process for handling end user data access and deletion requests
• Data processing agreement with Amazon
• The Swedish Data Protection Authority has been consulted

Data analytics

• All data is aggregated, individual users not identifiable

Sony corporate legal approval

• All handling of personal information is reviewed by Sony’s legal department