Security posture
Encryption in transit & at rest
All traffic is TLS 1.2+. Databases and object storage are encrypted at rest. Deploy tokens are hashed (never stored in plaintext) and shown once at creation; webhook payloads are signed with HMAC-SHA256.
Least-privilege access
Four organization roles plus per-project and per-language grants — on every plan, not just Enterprise. Deploy tokens carry scoped abilities (push / pull / manage / read / write) and an optional expiry.
Tenant isolation
Every query is scoped by organization and project. Cross-tenant identifiers 404 by construction — existence never leaks across workspaces. The one deliberate exception is the shared translation-memory pool, described below.
Auditability
An append-only audit log records logins, token and role changes, exports, billing, and SSO configuration across roughly 25 action types. Owners and Admins can export it as CSV. Available on Enterprise.
Subprocessors
The third parties that may process customer data on our behalf. We notify customers of material changes before a new subprocessor goes live.
| Subprocessor | Purpose | Region |
|---|---|---|
| Anthropic (Claude) | AI translation, QA, glossary extraction | United States |
| Amazon Web Services | Application hosting, database, object storage | Configurable region |
| Stripe | Billing & payment processing | United States / EU |
Translation memory & AI data handling
We do not train any model on your content. Metering records token counts for transparent economics — never the request bodies themselves.
Translation memory is a shared, anonymous, exact-match pool. An entry is keyed only by a hash of the source string, the target locale, and the model that produced it — it carries no organization or project identifier. That means an exact-match translation contributed by one workspace can be reused by another, at no quota cost to either. Entries record no attribution, and the pool is never exposed as a browsable corpus.
If that trade-off is not right for you, translation memory can be switched off per project, in which case that project neither contributes to nor reads from the pool. A private, organization-scoped translation memory is on the roadmap; we will not describe one as shipped before it is.
Compliance
Available today
- · GDPR-aligned data processing, plus a signable DPA
- · Data-subject export & deletion on request
- · SAML SSO sign-in with JIT provisioning, SCIM 2.0 provisioning, and audit-log export (Enterprise)
On the roadmap (honestly, not yet)
- · SOC 2 Type II — Type I readiness first, then the observation window
- · Configurable data residency (region pinning)
- · A fully org-private exact-match translation memory (the semantic memory is already org-scoped)
- · Penetration-test report available under NDA
We will not claim a certification we do not hold. If a control matters to your procurement, ask — we would rather tell you where we are than paper over it.
Uptime
Our uptime is published on an independently-hosted status page with incident history. Business and Enterprise plans carry a contractual SLA.
Accessibility
The console targets WCAG 2.1 AA: full keyboard navigation, focus management on dialogs and the command palette, screen-reader labels on the translation grid, and a reduced-motion mode. Automated axe-core checks run in CI.
Disclosure
Found a vulnerability? We acknowledge within two business days and will not pursue good-faith research conducted under this policy.
