Trust Center: Security, Quality Management & Transparency
Show, Don't Tell. Supervised by Akio Kato (Founder, Representative Director & CTO / Registered Information Security Specialist No. 007617 / Senior Healthcare Information Technologist / JP-RISSA Director) under joint executive governance with Yukari Shimazu (Representative Director & CEO).
1. NIST CSF 2.0 Defense Matrix & Operating Entity Profile
| NIST CSF 2.0 Function | Open Knowledge Implementation & Controls |
|---|---|
| GV : Govern | Dual-Representative Governance (CEO Yukari Shimazu & CTO Akio Kato, RISS No. 007617). Formal security policies, zero-AI-training guarantees, and supply-chain oversight. |
| ID : Identify | Continuous asset inventory, SBOM (Cargo.lock / package lock) dependency auditing, and external attack-surface monitoring. |
| PR : Protect | Zero-CMS static edge delivery (ap01.ok.st), Google Workspace Business Plus 30TB Context-Aware Access & FIDO2 Passkeys, and private-vLAN database isolation (db01.ok.st). |
| DE : Detect | FreeBSD pf packet filter telemetry, OpenZFS cryptographic block checksum verification, and Google Cloud Security Command Center continuous monitoring. |
| RS : Respond | Automated vLAN segment containment, forensic snapshot preservation, and 72-hour statutory notification workflow under RISS No. 007617 CSIRT leadership. |
| RC : Recover | FreeBSD OpenZFS Copy-on-Write immutable snapshots enabling near-instantaneous rollback against ransomware or logical corruption. |
Operating Entity & Governance Profile
- Company Name
- Open Knowledge Inc.
- Founded / Incorporated
- Founded April 2002 (as Open Knowledge Consulting LP) / Incorporated July 2013
- Paid-in Capital
- JPY 12,000,000
- Representative Directors
- Yukari Shimazu, Representative Director & CEO / Akio Kato, Founder, Representative Director & CTO
- Headquarters
- 2-2 Nomi-cho, Takatsuki-shi, Osaka 569-0077, Japan
- CSIRT & Trust Desk
- Phone: +81-72-628-9664 / Security & Official Email: e@ok.st
2. Two-Tier Infrastructure Isolation (`ap01.ok.st` / `db01.ok.st`) & Cookieless Privacy
Private-vLAN Database Vault (db01.ok.st)
Our primary database server (db01.ok.st) runs FreeBSD 15.1 with OpenZFS (LZ4 compression, 8 GB ZFS ARC cache, Copy-on-Write immutable snapshots) and PostgreSQL 19 enforcing FORCE ROW LEVEL SECURITY. Direct public IP access is physically and logically blocked at the firewall; access is restricted strictly to authenticated Rust services over a private vLAN.
Cookieless Privacy, 3s Secure Micro-Auth & Zero AI Training
ok.st deploys zero third-party tracking cookies and zero behavioral advertising pixels. Interactive labs provide a zero-load static sample preview followed by 3-second 1-tap secure sign-in (Passkey / Google / LINE / Magic Link) isolated per user on PostgreSQL 19 FORCE RLS, and client records are strictly excluded from foundation model training.
3. RFC 9116 Vulnerability Disclosure Policy (VDP) & Safe Harbor
Open Knowledge Inc. welcomes good-faith security research under IETF RFC 9116 (/.well-known/security.txt and /.well-known/pgp-key.txt). Reports are reviewed directly by our Registered Information Security Specialist (No. 007617) under the following service-level commitments:
Direct receipt confirmation from our RISS-led CSIRT team upon receiving a report at e@ok.st.
CVSS v4.0 severity scoring, root-cause validation, and remediation timeline notification.
We do not pursue legal action against researchers who test within scope without disrupting service or exfiltrating third-party data.
4. OpenZFS / PostgreSQL 19 Audit Telemetry & Hash-Chained Log Integrity
Audit logs stored on db01.ok.st employ append-only SHA-256 hash chaining (where each row's digest commits to the previous row's hash plus the current payload) backed by OpenZFS immutable snapshots:
{`-- PostgreSQL 19 (db01.ok.st) Tamper-Evident Audit Telemetry Table
CREATE TABLE security_audit_chain (
seq_id BIGSERIAL PRIMARY KEY,
recorded_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
actor_id TEXT NOT NULL,
event_type TEXT NOT NULL,
payload_json JSONB NOT NULL,
prev_hash BYTEA NOT NULL,
row_hash BYTEA GENERATED ALWAYS AS (
sha256(prev_hash || convert_to(recorded_at::text || actor_id || event_type || payload_json::text, 'UTF8'))
) STORED
);
REVOKE UPDATE, DELETE, TRUNCATE ON security_audit_chain FROM PUBLIC;`}