XML 38 R8.htm IDEA: XBRL DOCUMENT v3.25.1
Cybersecurity Risk Management, Strategy and Governance
12 Months Ended
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]

Risk Management and Strategy

We have implemented robust processes for assessing, identifying and managing material risks from cybersecurity threats and monitoring the prevention, detection, mitigation and remediation of material cybersecurity incident. We have also integrated cybersecurity risk management into our overall enterprise risk management system.

We have established a dynamic and multi-layered cybersecurity defense system to effectively mitigate both internal and external cybersecurity threats. This comprehensive system spans multiple security domains, including network, host, and application layers. It integrates a range of security capabilities such as threat defense, continuous monitoring, in-depth analysis and rapid response. Our approach to managing cybersecurity risks and safeguarding sensitive data is multi-faceted, involving technological safeguards, procedural protocols, a rigorous program of surveillance on our corporate network, ongoing internal and external evaluations of our security measures, a solid incident response framework, and regular cybersecurity training sessions for our employees. Our cybersecurity department is actively engaged in continuous monitoring of our applications, platforms and infrastructure to ensure prompt identification and response to potential issues, including emerging cybersecurity threats.

As part of the aforementioned processes, we regularly engage third parties to assess our internal cybersecurity programs and compliance with applicable practices and standards. The bug bounty program we have established enables independent security researchers to aid us in identifying potential vulnerabilities and further mitigating risks. We have implemented a set of procedures to ensure effective management of the cybersecurity risks associated with the use of third-party service providers. These procedures include, but are not limited to, conducting cybersecurity assessments and tracking the capabilities and qualifications of third-party security service providers through our supplier assessment process. Additionally, for independent security researchers, we require adherence to the security-related agreement when submitting vulnerabilities.

As of the date of this annual report, we have not experienced any material cybersecurity incidents or identified any material cybersecurity threats that have affected or are reasonably likely to materially affect us, our business strategy, results of operations or financial condition.

Governance

Our board of directors is responsible for overseeing our cybersecurity risk management. Our board of directors shall (i) maintain oversight of the disclosure related to cybersecurity matters in current reports or periodic reports of our company, (ii) review updates to the status of any material cybersecurity incidents or material risks from cybersecurity threats to our company, and the disclosure issues, if any, on a quarterly basis, and (iii) review disclosure concerning cybersecurity matters in our annual report on Form 20-F.

At management level, we have established a cybersecurity committee that consists of the company’s senior management, including the person in charge of our cybersecurity department. Our cybersecurity committee is responsible for overseeing the process of assessing, identifying and managing material risks from cybersecurity threats to our company and monitoring the prevention, detection, mitigation, and remediation of material cybersecurity incidents. The representative of our cybersecurity committee reports to our board of directors (i) on a quarterly basis regarding updates to the status of any material cybersecurity incidents or material risks from cybersecurity threats to our company, and the disclosure issues, if any, and (ii) on disclosure concerning cybersecurity matters in our annual report on Form 20-F.

If a cybersecurity incident occurs, our cybersecurity department will promptly organize personnel for internal assessment and report to our cybersecurity committee. If it is determined that the incident could potentially be a material cybersecurity event, the incident and assessment results will be promptly reported to the disclosure committee consisting of the senior principals in charge of our disclosure controls and procedures, and external legal counsel to the extent appropriate. Our disclosure committee will prepare disclosure material on the cybersecurity incident for review and approval by our board of directors before it is disseminated to the public.

Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block]

We have implemented robust processes for assessing, identifying and managing material risks from cybersecurity threats and monitoring the prevention, detection, mitigation and remediation of material cybersecurity incident. We have also integrated cybersecurity risk management into our overall enterprise risk management system.

Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block]

Governance

Our board of directors is responsible for overseeing our cybersecurity risk management. Our board of directors shall (i) maintain oversight of the disclosure related to cybersecurity matters in current reports or periodic reports of our company, (ii) review updates to the status of any material cybersecurity incidents or material risks from cybersecurity threats to our company, and the disclosure issues, if any, on a quarterly basis, and (iii) review disclosure concerning cybersecurity matters in our annual report on Form 20-F.

At management level, we have established a cybersecurity committee that consists of the company’s senior management, including the person in charge of our cybersecurity department. Our cybersecurity committee is responsible for overseeing the process of assessing, identifying and managing material risks from cybersecurity threats to our company and monitoring the prevention, detection, mitigation, and remediation of material cybersecurity incidents. The representative of our cybersecurity committee reports to our board of directors (i) on a quarterly basis regarding updates to the status of any material cybersecurity incidents or material risks from cybersecurity threats to our company, and the disclosure issues, if any, and (ii) on disclosure concerning cybersecurity matters in our annual report on Form 20-F.

If a cybersecurity incident occurs, our cybersecurity department will promptly organize personnel for internal assessment and report to our cybersecurity committee. If it is determined that the incident could potentially be a material cybersecurity event, the incident and assessment results will be promptly reported to the disclosure committee consisting of the senior principals in charge of our disclosure controls and procedures, and external legal counsel to the extent appropriate. Our disclosure committee will prepare disclosure material on the cybersecurity incident for review and approval by our board of directors before it is disseminated to the public.

Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] Our board of directors shall (i) maintain oversight of the disclosure related to cybersecurity matters in current reports or periodic reports of our company, (ii) review updates to the status of any material cybersecurity incidents or material risks from cybersecurity threats to our company, and the disclosure issues, if any, on a quarterly basis, and (iii) review disclosure concerning cybersecurity matters in our annual report on Form 20-F.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] The representative of our cybersecurity committee reports to our board of directors (i) on a quarterly basis regarding updates to the status of any material cybersecurity incidents or material risks from cybersecurity threats to our company, and the disclosure issues, if any, and (ii) on disclosure concerning cybersecurity matters in our annual report on Form 20-F.
Cybersecurity Risk Role of Management [Text Block]

At management level, we have established a cybersecurity committee that consists of the company’s senior management, including the person in charge of our cybersecurity department. Our cybersecurity committee is responsible for overseeing the process of assessing, identifying and managing material risks from cybersecurity threats to our company and monitoring the prevention, detection, mitigation, and remediation of material cybersecurity incidents. The representative of our cybersecurity committee reports to our board of directors (i) on a quarterly basis regarding updates to the status of any material cybersecurity incidents or material risks from cybersecurity threats to our company, and the disclosure issues, if any, and (ii) on disclosure concerning cybersecurity matters in our annual report on Form 20-F.

Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] At management level, we have established a cybersecurity committee that consists of the company’s senior management, including the person in charge of our cybersecurity department. Our cybersecurity committee is responsible for overseeing the process of assessing, identifying and managing material risks from cybersecurity threats to our company and monitoring the prevention, detection, mitigation, and remediation of material cybersecurity incidents.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block]

If a cybersecurity incident occurs, our cybersecurity department will promptly organize personnel for internal assessment and report to our cybersecurity committee. If it is determined that the incident could potentially be a material cybersecurity event, the incident and assessment results will be promptly reported to the disclosure committee consisting of the senior principals in charge of our disclosure controls and procedures, and external legal counsel to the extent appropriate. Our disclosure committee will prepare disclosure material on the cybersecurity incident for review and approval by our board of directors before it is disseminated to the public.

Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true