Insights
Insights
Practical guides you can actually use in the field — from commissioning and building to running systems — from a development company's point of view.
Speech recognition accuracy of AI phone agents and voicebots | What voice AI vendors publish, and voicast's results
We checked how far major AI phone and voicebot products in Japan publish their speech recognition accuracy. We also present the results of internal tests of voicast, our voice AI agent platform (Standard Japanese 94%, dialects 93%), together with their conditions.
After a wave of data breaches in Japan, account takeover comes next: what to review in your sign-in
Since late September 2026, Japanese companies have disclosed breaches affecting millions of customer records, and on October 9 the National Cybersecurity Office asked businesses to tighten their defences. This article explains how leaked email addresses and names are turned into account takeover, and what to review in your sign-in now.
Build vs. buy for sending webhooks | What a managed webhook service takes off your plate
Once you add retries, signing, delivery logs, static source IPs and a customer-facing portal, sending webhooks becomes a platform of its own. This article lists what building it in-house involves, how companies use dedicated webhook services, and what to check before handing sending to one.
What is Standard Webhooks? The open spec for signing and verifying webhooks
Standard Webhooks is an open specification that gives webhook signatures and headers one common format. This article covers the webhook-id, webhook-timestamp and webhook-signature headers, how the HMAC-SHA256 signature is computed, key rotation, and signature verification in Node.js.
Choosing a security-guard management system | Features and pricing
How to choose a management system for a Japanese security company covering control, assignments, check-in and check-out, reports, payroll and billing, and statutory records, with the published pricing of the main services as of September 2026.
Digitising security-guard reports | On-screen signatures and statutory records
What to check when moving security-guard reports from paper to digital: how reports are submitted to clients, how on-screen handwritten signatures are treated, and when the records required by the Security Services Act may be kept as electronic data.
Choosing a regulation management system | Features and pricing
The six features to compare when choosing a regulation management system in Japan: versioning, change tables, read records, law changes, permissions and search. Also covers the published pricing of the main services as of September 2026.
Moving security-guard shift and assignment management to the cloud | Check-in apps, e-signed reports and Security Services Act records
Control-room work at a security company runs on paper and phone calls: headcount and qualifications per site, guard preferences and clashes, check-in and check-out confirmations, client reports. This article covers the constraints to write down before systemising assignments, GPS check-in for attendance, e-signed reports, and how it all relates to the records the Security Services Act requires at each office.
How to amend work rules in Japan | Employee opinions, filing with the Labour Standards Inspection Office, notification, and revision history
Amending work rules (shugyo kisoku) or internal regulations is not finished when the text is edited. Japanese law requires hearing employee representatives, filing with the Labour Standards Inspection Office and notifying employees, and audits expect a record of what changed, when and why. This article covers the legal steps, the gaps in Word-and-email management, and the version-control requirements that stand up to ISMS and labour audits.
How to design a loyalty points programme | Earn rules, expiry, FIFO redemption, refunds and fraud controls for membership apps
Points are the hardest part of a membership app to change later. Lowering the earn rate upsets members; changing expiry means rebuilding the ledger. This article lists what to decide up front: earn rules, expiry and forfeiture, FIFO redemption order, refunds, double-earn and other fraud controls, and the legal and accounting checks.
Designing an AI avatar for reception and customer service | Response design, scripts, multilingual support and personal data
Talking AI avatars (digital humans) are being used for unstaffed reception, enquiry desks, first-round interviews and whistleblowing intake. The avatar does not think up the answers: your chatbot or a script does, and the avatar speaks. On that basis, this article covers response latency, languages, personal data and cost before you deploy.
How to roll out passkeys | A staged path to passwordless login: prompting enrolment, coexistence, recovery, retiring passwords
Adding a passkey button to an existing login page does not get users enrolled. You need a prompt that works, a coexistence period with passwords, recovery for lost or replaced devices, and a decision on when to retire passwords. This guide splits a passwordless migration into four stages and lists what to decide at each.
What passkeys are, why they took off, and how to add them to an existing service
Yahoo! JAPAN is ending password-only sign-in and Mercari has passed 10 million passkey users. This article explains how passkeys stop phishing, what the adoption numbers look like in Japan and worldwide, where rollouts get stuck, and how to add passkeys to a login you already have.
Stop rebuilding the back end of every membership app | The case for a headless membership platform (API)
Points, coupons, stamp rallies, push delivery — the back end of a membership app is nearly the same from project to project, yet it gets rebuilt from scratch every time. What changes when you carve that back end out as a headless API? When it fits, when it doesn't, and what to check before adopting one.
A Guide to Outsourcing AI Agent Development: Choosing the Right Firm and Understanding Costs
Outsourcing the development of autonomous AI agents is surging. We explain how to choose a development partner, what to expect on cost, and what to sort out before you commission, so your project doesn't stall at the PoC stage.
The Benefits of Migrating from WordPress to Cloudflare | AI-Native Content Operations, Speed, and SEO Optimization
The advantages of moving away from the maintenance and security burden of WordPress to a static Astro + Cloudflare Pages architecture. We cover how to build an 'AI-native' operation—one where you keep content as Markdown in Git and generative AI can run it directly—without losing display speed or SEO (in fact strengthening them), along with the key points of the migration.
How to Bring a Vibe-Coded App Up to Production Quality
You built something that works with 'vibe coding'—instructing an AI to build an app. But is it safe to use in production? We cover the typical weaknesses of in-house AI development and the checkpoints for raising it to production quality.
How to Migrate to Google Workspace: The Sequence for Switching Without Email Downtime
We explain the Google Workspace migration process from the big picture—domain setup, MX cutover, and data migration. We cover the switch order that keeps email running, setting up SPF/DKIM/DMARC, and common pitfalls.
Why Legacy System Overhauls Fail: How Generative AI Is Changing Modernization
We explain the structural reasons a full replacement of a legacy system tends to fail, the strangler pattern for migrating in stages, and how generative AI has changed the cost of analysis and migration—together with what to sort out before you start.
What Is AI Search Optimization (AIO/GEO): How to Build a Site That ChatGPT Cites
We explain optimizing your site to be cited by ChatGPT and AI search (AIO/GEO): how it differs from traditional SEO, concrete measures such as llms.txt, structured data, and citation-friendly content structure, and how to measure results.
Quasi-Mandate vs. Contract for Work in System Development: Criteria for Deciding Which to Use
We organize the difference between the quasi-mandate and contract-for-work contract types in system development from the angles of completion liability, non-conformity liability, and direction/command. We include a table of which suits which case, cautions on disguised contracting, and clauses to check in the contract.
Preventing WordPress Defacement and Takeover | A Checklist of What to Do Today
The real intrusion routes by which WordPress gets defaced or taken over, and a priority-ordered checklist of countermeasures. We also cover the first response if you do get defaced, and the criteria for deciding whether to outsource maintenance.
Stop Deploying by Hand: The Benefits of CI/CD and How to Start Small
What CI/CD is, explained from the typical accidents of manual deployment. We introduce a three-stage approach to adopting it small with GitHub Actions—test automation → build → deploy—and the points where people commonly stumble.
What Is Uptime Monitoring | What a Company Loses by Not Noticing an Outage, and How to Set It Up
What uptime monitoring is, starting from how it differs from synthetic monitoring. What you lose by failing to notice a site outage, the practical work of monitoring intervals, alert design, and SSL expiry monitoring, the limits of free tools, and where managed monitoring earns its keep.
Seven Reasons AWS Bills Get High and How to Cut Them: The Billing Items to Look at First
If your AWS bill feels high, where in the billing dashboard should you look first? We explain seven typical sources of waste—such as unused resources and over-provisioned specs—and the practical steps for driving costs down.
What Companies Must Do Under the Whistleblower Protection Act: Building an Internal Reporting System and the Requirements a Channel Needs
We organize the systems companies are required to put in place under the revised Whistleblower Protection Act, and explain—from a development company's perspective—the requirements a reporting channel must meet in practice (anonymity, independence, audit trails, multilingual support) and common shortcomings.
A "Build Small and Confirm" Approach to Avoid Failing at System Development: Where PoC and MVP Fit
Before signing a multi-million-yen development contract outright, we explain the approach of confirming your hypothesis with a PoC or MVP. We cover which cases it suits, which it doesn't, and the conditions for connecting a PoC to full development.
How to Isolate What's Making WordPress Slow | Server, Theme, or Plugin—Who's the Culprit?
When WordPress displays slowly, we explain the steps to isolate for yourself whether the cause is the server, theme, plugins, or images. We introduce speed-up measures in order of impact.
How to Approach a Server Migration | Steps, Typical Costs, and Planning to Minimize Downtime
From shared hosting to the cloud—the standard steps of a server migration, typical costs, the planning that minimizes downtime at cutover, and the points where it tends to go wrong.
Comparing Competitive Bids in System Development | Evaluation Axes and How to Read a 'Cheap Estimate'
How to compare proposals and estimates from multiple firms. How to build evaluation axes, the items you must always check in an estimate, and the three patterns hidden in a cheap quote—explained for buyers.
How to Write an RFP | Drafting with AI, and Why You Should Never Ship the Draft As-Is
What an RFP must contain, how to draft one efficiently with generative AI, and the problems that arise when you submit an AI draft unedited—plus the final review points, explained from a development firm's perspective.
Let's talk.
Everything you share is handled in confidence. We reply within two business days.