To ensure our customers can use Shifter with confidence, we operate our service with security as our top priority.
Highly Reliable Data Centers
We use Amazon Web Services (hereinafter “AWS”) as the data center provider for our service.
The locations of AWS data centers are planned with disaster risks in mind, and operations are conducted across multiple physically separate data centers to ensure redundancy. Only a limited number of authorized personnel within AWS are aware of the data center locations; even AWS employees are not informed of them.
AWS holds third-party certifications such as PCI, ISO, and SOC, and operates under numerous other public audits (for details on AWS’s third-party certifications, click here).In addition to its growing adoption in the financial and healthcare sectors within Japan, AWS has been adopted as the Japanese government’s “Common Government Platform” since October 2020.
Shifter’s policies and practices regarding infrastructure comply with AWS guidelines.
Your account information (username, email address, and billing information) is stored in Japan, while data for websites—such as WordPress sites hosted on Shifter—is stored in data centers in the United States. If you need to use a data center located outside the United States, please consider using Amimoto Managed Hosting.
Always Running the Latest Version of WordPress
WordPress is automatically updated, ensuring you are always using the latest version.
You can check the WordPress version and the plugins you are using in the WordPress admin panel.
Strict Access Restrictions and Security Measures
Access to the AWS infrastructure on which Shifter operates is restricted to system operations staff, and all operation logs are automatically saved.
Furthermore, we do not access data stored on your site except when requested by you, such as for investigative purposes.
In addition, regarding the handling of personal information, we operate in accordance with our Terms of Service and Privacy Policy, and we strive to thoroughly implement security measures and raise security awareness.
Third-Party Certification
We have obtained ISMS (ISO/IEC 27001) certification.
Reliable Data Backups
We perform regular backups to prepare for data loss caused by system failures or human error.
Additionally, by enabling the “Automatic Backup Generation” feature in Shifter, you can capture a backup at the time of generation.
Prevention of Unauthorized Access
Delivered as Static Content
Shifter is designed to convert websites managed by WordPress into static files and publish them. Websites built using standard WordPress are called “dynamic sites”; every time a user accesses the site, a program runs to generate the web page on the fly.
Cyberattacks often exploit this characteristic by injecting malicious code through vulnerabilities in WordPress or its plugins. However, with Shifter, even though you’re using WordPress, it generates and publishes a “static site” using only HTML, CSS, and JavaScript, so no malicious code is executed on the server side.
WordPress is launched only when necessary
When using WordPress in its standard configuration, the login URL for the admin panel can be easily guessed, posing a risk of unauthorized access if no countermeasures are taken.
Shifter is designed to launch WordPress only when creating or editing posts, significantly reducing the risk of unauthorized access to the admin panel.
We conduct vulnerability scans on the admin panel
As part of our efforts to enhance security, we regularly perform security tests using vulnerability scanning tools on the Shifter dashboard (go.getshifter.io) *.
For the scan results, please see here.
*Users are prohibited from conducting vulnerability assessments on the Shifter dashboard.
Communications are encrypted via HTTPS by default
The Shifter site uses HTTPS encryption by default, ensuring that your important data is transmitted in an encrypted state.
Comprehensive Outage Countermeasures: Use with Confidence Every Day
Monitoring and Outage Response
We monitor the status of each managed service that makes up Shifter and have established systems for alerts and automatic recovery.
We Provide Timely Updates During Outages and Maintenance
For planned outages due to maintenance, we generally provide advance notice via Shifter notifications one week in advance.In the event of an outage, we will report the status on the Shifter website or our corporate website.
Estimated Recovery Times for System Outages
Outages affecting the dashboard used for site operations and contract management: Within 24 hours
Platform outages: Within 24 hours
Provision of Security Checklists
We provide security checklists that comply with the “Cloud Service Level Checklist” issued by the Ministry of Economy, Trade and Industry (METI) and the “Guide to Creating Secure Websites, 7th Revised Edition” published by the Information-technology Promotion Agency (IPA). Please use these when considering the implementation of Shifter.
Download the Security Checklist
The scope of the security checklist covers the Shifter management console and the infrastructure layer, including the OS and middleware we provide.
It does not cover WordPress (including plugins and themes) or web applications running on Shifter that are not listed above; these fall under your own management responsibility.
If you would like us to complete a security checklist tailored to your specific needs, we can accommodate this as a separate paid option.
Additionally, if you have commissioned us to build a website and would like to request a “Security Check for Deliverables,” please feel free to contact our support team.