Controls we have
Each row is a control the service runs today. The last column says how it is enforced, so a reviewer can ask us to show it.
| Control | What it means for you | How it is enforced |
|---|---|---|
| Hosting region | The application and its data volume run on Railway in its europe-west4 region, in the Netherlands. | The deployment is configured for that region. |
| Workspace isolation | Profiles, glossaries, uploads, runs and reports belong to one workspace. One workspace cannot read another's. | Every request is scoped to the workspace of the person signed in, and every query carries that workspace. |
| Roles | Five roles: Admin, Quality Lead, PM, Linguist and Translator. A translator sees only their own runs. | Every permission is checked again on the server; hiding a page in the app is a courtesy, not the boundary. |
| Sessions | A sign-in lasts 14 days, then you sign in again. | The session expiry is fixed on the server. Only a fingerprint of the session token is stored. |
| Sign-in | Email and password, or Google sign-in if you choose it. | Google sign-in is the standard consumer sign-in with Google. |
| Operator two-step verification | Our own operator accounts can enrol in a second factor with an authenticator app. Once enrolled, an operator session must verify a code before its first operator action, and the verification lasts twelve hours on that session; then it asks again. | A code is accepted once, five wrong codes lock the operator out for fifteen minutes and the secret is encrypted with its own key. |
| Operator audit log | Every change an operator makes to a workspace, a plan or an account is written to a log, with the changed fields only and never your content. | The rows are chained by a keyed hash, so an edited, removed or cut-off row is detected when the log is verified. On production the database refuses to update or delete a row. |
| Workspace audit trail | Your workspace has its own trail: who signed in, who changed a role or a key, who exported a report or downloaded a corrected copy, who changed a finding, raised or resolved a dispute, finalized or reopened a scorecard. A workspace admin reads it and downloads it as CSV through the API. | Each row holds the action and the fields that changed, never a segment's text or a comment. The rows form a hash chain per workspace that the API can verify, and on production the database refuses to update or delete a row. |
| Decision history | Every decision on a finding (ignored, confirmed, fixed) records who made it and when. | The history is written by the server when the decision is saved, not by the browser. |
| Retention per workspace | A workspace admin sets how many days QA reports and finalized LQA scorecards are kept, from 30 to 3,650 days. Unset keeps everything until an admin deletes it. | A nightly sweep deletes what is older than the setting, with its files, decisions, edits and sign-offs, at most 2,000 reports a night, and writes one row to the workspace audit trail each night. The setting is made in Settings under Security and data or through the API (Retention). |
| Connector secrets | Tokens for Crowdin, Smartling, Dropbox and webhooks are encrypted in storage and never returned by the API, including to you. | Encrypted at rest with a key held outside the database. A value that cannot be decrypted is treated as missing, never used as is. |
| Webhooks | A webhook from your platform is checked against your connection's own secret. A Smartling delivery must also arrive inside a five-minute window. The webhooks we send you are signed with your secret over the event, its time and its body. | A delivery with a bad signature is refused, as is a Smartling delivery with an old timestamp. Every refusal gets the same answer. |
| Browser protections | Our pages cannot be framed by another site and cannot load plugins. | A content security policy is sent on every response. |
| Signed report links | A report link that works without a sign-in is read-only, expires and can be revoked. | The link carries a signature and an expiry that the server checks. A suspended workspace's links stop working. |
| Logs without content | Our logs never carry your source or target text, findings, glossary entries or file names. A connector's project identifier, as the platform sends it, may appear in a log line about that connector. | Every log line that would name your content or a file uses a short fingerprint instead. |
| Error tracking without content | When the service hits an error, the report we receive keeps the shape of the fault and drops your text, files, findings and reports. | Every error event is scrubbed on our server before it is sent. |
| Safe file reading | A bilingual file cannot make the service fetch another file or address. | XML is read with external entities and network access turned off. |
| Known versions only | The service runs the exact library versions we tested. | Every build installs from a lock file with a hash for each file and fails on any difference. The locked set is scanned for known vulnerabilities when it changes. |
| AI provider choice | Your workspace admin chooses which AI providers may receive your text. With no provider allowed, the rules still run and no text goes to a model. | The allow-list is checked before every model call; if it cannot be read, nothing is sent. |
| Untrusted text in every model stage | A segment that contains instructions is treated as content, not as a command. | In the segment review and in the whole-file review the source and target are wrapped as untrusted data before they reach a model. An answer that carries the prompt's marker or eight words in a row copied from the prompt is dropped before it is stored; a shorter paraphrase is not caught. |
| A person signs off | A model proposes. No report is final until a reviewer confirms or overrides. | Sign-off is a separate step that only a person can take in the app. |
| Upload removal | An uploaded file is removed within 24 hours. A workspace can agree a longer keep for its uploaded files with us; we set it per workspace. | A cleanup job removes uploads well inside that bound. An uploaded file is not in a backup, except an original kept for the review editor or under a workspace's agreed longer keep, which is in the nightly backup for 14 days like a report. |
| Backups | The service is backed up every night and kept for 14 days. The account database is also copied every hour. | See Backups, recovery and continuity. |
| Your own data | You can download your personal data and delete your account in User settings. A workspace admin can export or delete the whole workspace. | Deleting an account replaces your address everywhere it appears; only a keyed hash of it is kept, so the deletion can be proven. |
| Monitoring | We are alerted when the service, a backup or an hourly copy fails. | An external uptime monitor and the service's own health checks. |
What we do not have
We would rather say no than imply a yes.
- We do not hold SOC 2 or ISO 27001, and we do not claim either is in progress.
- There is no SAML single sign-on and no SCIM provisioning.
- A workspace cannot require two-step verification for its members.
- There is no IP allow-list.
- No third-party penetration test has been performed yet. A summary is shared under NDA once one exists, on request.
- There is no accessibility conformance report (VPAT).