SOOP ESG2024

SOOP recognizes data security and privacy to be core responsibilities given the nature of our platform, where user activity data and personal information are collected and processed real-time. We aim to strengthen user trust and enhance the sustainability of our platform by increasing our investment in data protection and transparently disclosing our security status.

Strategy & Policy

Considering data security and privacy as core values, SOOP operates an integrated data protection system based on ISMS certification. We have established a governance framework that includes personal information impact assessments, internal audits and operation of cyber threat response teams. In addition, we have established various comprehensive internal guidelines, including the Data Protection Regulations and guidelines for users, servers and personal security, to define clear expectations and performance standards required of employees and partners. We also regularly conduct prevention-centered security activities such as data protection training, malware drills, sharing latest security trends and system security updates to raise company-wide security awareness and create an environment that can proactively respond to changing cyber threats.

Privacy Protection Principles

2024 key Performance

Operation of the Information Technology General Controls (ITGC)

In 2023, SOOP established an external audit response system for its internal accounting management framework pursuant to the Act on External Audit of Stock Companies and overhauled its IT control activities based on Information Technology General Controls (ITGC). ITGC is a basic control system that ensures the reliability and stability of IT systems, covering areas such as data integrity, system access security, program development and change management, as well as backup and disaster response management. In 2024, we continued with regular inspections and improvements on key IT control components, including major data changes, system access controls and program development and operations management. This ensures the reliability of financial information and data integrity, as well as the maintenance of a stable internal control system.

Raising Information Security Awareness

SOOP raises information protection awareness through various activities targeting employees and users. The Security Team regularly shares updates on domestic and international security issues, as well as internal information security trends, with all employees every month, helping prevent security incidents and increasing security sensitivity. In addition, our Personal Information Protection Campaign guides users on self-protection practices such as stronger passwords, two-factor authentication and blocking overseas logins, foster a safer service environment.

Information Security Training in 2024

Privacy Protection

Security Control of Personal Information Processing

SOOP designates and systematically manages all business systems, databases and management systems that handle personal information necessary to provide user services as “personal information processing systems.” We have established clear authorization criteria and operating procedure for access, inquiry, modification, extraction, etc. related to the processing of personal information, and control such processes to ensure that personal information is safely protected. We apply secure authentication methods to prevent access by third parties, and encrypt access paths to protect against external threats. In addition, we grant only the minimum necessary permissions for each system menu to ensure that personal information processors access only the information required for their work. Authorization must be obtained from both the personal information protection officer and information security officer respectively by a separate authorization process. Even after authorization is granted, we regularly review and revoke unnecessary authorizations. All actions such as access, creation, modification and deletion are recorded (logged) and kept for a specified period of time to maintain the safety and reliability of the personal information processing system.

Preventive Measures and Post-Monitoring

SOOP has various prevention and inspection systems in place to prevent and systematically manage personal information leakages. First, we identify risk factors in advance through personal information impact assessments, and strengthen internal controls by integrating and managing the authorization and usage status of personal information handlers. We also ensure the safety of outsourced personal information processing by adopting a framework that requires self-inspections by outsourcing companies and prompt correction requests. Further, we conduct annual inspections, including personal information status checks, and systematically carry out follow-up measures by regularly monitoring access and change logs, and through a final confirmation by the CPO. If an outsourcing company fails to take the required improvement measures, we conduct on-site inspections and take additional measures to ensure effective management. By linking these preventive actions with post-monitoring, we continuously enhance our company-wide personal information protection capabilities.