An independent body of external experts contributes to advancing data governance
Ongoing discussions on policies and operations regarding customer data protection

Viva Republica, the operator of the financial super app "Toss,” announced that it is marking the 2nd anniversary of the Data Protection Compliance Advisory Committee (Committee).

Established in November 2022, the Committee serves as an independent advisory body that strengthens Toss’ customer data protection and independently monitors compliance with relevant laws. The Committee is led by Korea University’s Graduate School of Cyber Security Professor Hun-Yeong Kwon with Professor Seungjoo Kim from the same graduate school and Legal Advisor Chuljoon Kim from Kim & Lee Law Firm serving as members.
Since its launch two years ago, Toss has shared its data protection policies and operational strategies with the Committee for expert consultation. Key agendas have included enhancing data management, refining data governance, ensuring regulatory compliance and legal adaptation, developing an AI governance framework, strengthening customer data sovereignty, and fostering trust in data protection practices.
Based on these discussions, Toss has achieved concrete milestones, including being the first fintech company in Korea to obtain CBPR (Cross-Border Privacy Rules) certification, establishing a Third-Party Risk Management (TPRM) system for data handling with external partners, and launching a Personal Information Safety Report for users.
At the 5th regular meeting, held to mark the 2nd anniversary of the Committee’s establishment, reports were presented on improvements to personal data collection agreements in response to amendments to the Personal Information Protection Act, as well as technical and administrative protection measures for biometric data. The Committee gathered opinions on these matters.
"The Committee has played a crucial role in independently overseeing Toss’ data utilization and protection efforts, contributing to the advancement of our data governance system over the past two years,” a Toss representative said. “Moving forward, we will continue discussions on transparency and trust while establishing new standards for data protection in the financial industry."


An independent body of external experts contributes to advancing data governance
Ongoing discussions on policies and operations regarding customer data protection

Viva Republica, 

Ongoing discussions on policies and operations regarding customer data protection

Toss Marks 2nd Year of Data Protection Committee

Now in its second year, the event featured security and information protection best practices from Toss and its affiliates.
Over 400 security experts from various industries attended, sharing insights on strengthening security capabilities.

Viva Republica, the operator of the financial super app "Toss," announced the successful conclusion of its “Guardians 2024” security conference.

Guardians is an event where security professionals from Toss and its affiliates share their expertise in information security and discuss strategies for enhancing security capabilities. Now in its second year, the event took place on November 25 at the Sofitel Ambassador Seoul Hotel.
A total of 23 security professionals from Toss, Toss Bank, Toss Securities, and Toss Payments participated as speakers, presenting insights into Toss’ security culture, capabilities, and best practices. The conference featured 22 sessions on three tracks: information security management & personal information protection, security architecture & vulnerability management, and data asset protection & security threat monitoring.
The opening keynote was delivered by Jungho Chi, Chief Information Security Officer (CISO) of Toss Securities, who highlighted Toss’ efforts in building a robust security framework within the fast-evolving fintech industry. He emphasized the importance of ongoing research, investment, and knowledge-sharing events like this to effectively combat security threats.
Approximately 400 security experts from various industries attended the event. They discussed technical security issues and shared expertise, reaffirming the importance of the information security community.
“Toss is committed to leading the way in security investment and research to ensure a safe and convenient financial experience,” a Toss representative said. “By sharing actual case studies and security threat response knowledge, we hope to contribute to the advancement of financial security in Korea.”



Now in its second year, the event featured security and information protection best practices from Toss and its affiliates.
Over 400 security experts from various industries attend

Over 400 security experts from various industries attended

Toss Successfully Concludes "Guardians 2024" Security Conference

Competed in FIESTA 2024, solving all cybersecurity challenges to secure top spot
Fourth consecutive victory since 2021, reaffirming top-tier security capabilities in Korea

Viva Republica, the operator of the financial super app "Toss," announced that it has won the FIESTA 2024 (Financial Institute’s Event on Security Threat Analysis) competition, hosted by the Financial Security Institute (FSI).

This event was held to enhance cyber threat analysis and incident response capabilities in the financial sector. Participating teams are presented with cybersecurity questions based on real-world cyber threat scenarios to determine a winner. This year’s event took place from October 4 to October 6 over three days.
Toss participated under the team name “Decaffein Matcha Latte,” consisting of four white-hat hackers from its security team: Jeongsu Choi, Jaeseung Kwon, Dongseok Kang, and Jaesung Kim. They successfully solved all the questions related to cyberattacks in areas such as generative AI, cloud, and supply chain, securing first place. Since first competing in 2021, Toss has won the competition four consecutive times, demonstrating its top-tier financial capabilities in Korea.
Toss has a dedicated white-hat hacking team, including the four competition participants. The team regularly conducts cyberattack drills to enhance its security framework. It also runs a bug bounty challenge (simulated hacking competition) year-round to research new security technologies.
As a result, Toss has obtained global security and data protection certificates, including ISO27001, ISMS-P, PCI DSS Level 1, and ISO 27701, receiving recognition for maintaining a world-class information security system.
“We are happy to prove our security capabilities with this fourth consecutive win,” a Toss representative said. “We will continue investing in and researching security to ensure a safe financial experience for our customers.”


Competed in FIESTA 2024, solving all cybersecurity challenges to secure top spot
Fourth consecutive victory since 2021, reaffirming top-tier security capabilities in Korea

Viva Re

# Security

Toss Marks 2nd Year of Data Protection Committee

Toss Successfully Concludes "Guardians 2024" Security Conference

Toss Wins FIESTA Competition Hosted by FSI