In 2026, many of the security incidents disclosed by Japanese companies did not start inside their own systems. They started at a supplier: a cloud provider, a system operator, or a software development partner with access to their code.
A single ransomware attack on one Japanese cloud platform in October affected 495 companies and local governments at once.
For any company working with an offshore software development partner, the lesson is simple. Your security is only as strong as your weakest vendor. Here are ten questions to ask a software development partner before you sign — and what a good answer looks like.
10 security questions to ask a software development partner
01Is your information security certified, and what exactly is in scope?
A good answer names the standard (ISO/IEC 27001), the version, the certification body and the scope. "We follow best practices" is not an answer. Ask for a copy of the certificate.
02Where will our data and source code live?
You should know whether work happens in your environment, the vendor's environment, or both — and in which country.
03How do engineers access our systems?
Look for VPN with multi-factor authentication, named accounts, and no shared passwords. Old VPN appliances without MFA were a common entry point in recent Japanese ransomware cases.
04Is our project separated from other clients' projects?
Separate repositories, environments and credentials per client limit the damage if one project is compromised.
05Do developers work with real production data?
A careful vendor uses masked or synthetic data in development and testing wherever possible.
06Who can see what, and how is access removed?
Ask how access is granted on a need-to-know basis and how quickly it is revoked when someone leaves the project.
07What happens if there is an incident?
A good vendor can tell you who will contact you, how fast, and what information you will receive. Ask for the incident response procedure in writing.
08Will you complete our vendor security checklist?
Most Japanese companies have one. A prepared vendor answers it in days, not weeks.
09What happens to our data when the project ends?
Expect a clear process: return, deletion, and a written confirmation.
10How do you keep the software itself secure after delivery?
Security does not end at handover. Ask how dependencies, frameworks and runtimes are kept patched — for example, how quickly a critical vulnerability in a core language like PHP is fixed across your systems.
Legacy systems are often the weakest link
Many of the systems exposed this year were old: outdated runtimes, unpatched VPN devices, applications no one dares to touch. Modernizing these systems is not only about features. It removes years of accumulated security risk.
TPS as your software development partner: how we keep your data secure
For TPS, security is certified, not self-declared. Our information security management system is certified to ISO/IEC 27001:2022 by QRO Certification LLP (certificate no. 305025121607IS), covering software and solution development, managed IT services, data engineering and AI application development. The certificate is checked every year through surveillance audits.
The same ten questions above are the ones we answer every day:
Modernization that removes risk, not just old code
Outdated runtimes, unsupported frameworks and systems no one dares to touch are where security problems hide. When PHP released critical fixes on 21 October 2026, systems on versions too old to receive the fix were left without a simple way out. We explain the options in PHP Security Release of 21 October 2026: Options for Systems That Cannot Simply Be Updated.
TPS modernizes these systems in three ways:
For a platform in Japan, this recovered 38 business flows from three production systems, with 657 working steps traced to the code (read the case study).
Our approach is AI-accelerated and human-accountable: AI speeds up code analysis and testing, and senior engineers own every decision. We can work alongside your current software development partner, and every engagement starts with a small paid pilot.
Start with a Legacy Modernization Health Check
Tell us what your current system runs on and the decision you're facing: refactor, migrate, or rebuild. TPS comes back with a written view of your options, not a sales deck.
30 minutes · In English or Japanese · NDA available before any code is shared
