Get started

Security overview

Details supplied by the owner

This page describes how LgTranslate protects your account and your content. It is Annex II of our Data Processing Agreement. We describe what we actually do, and we say where we have not yet done something. No system is perfectly secure; if you find a problem, please tell us at [OPEN: mailbox].

1. What we do

Area Measure
Connections All traffic to the website, dashboard and API uses TLS. Pages are served with strict security headers (HSTS, content security policy and others).
Sign-in Passwords are stored only as salted one-way hashes (PBKDF2-HMAC-SHA256, 600,000 iterations) and must be at least 15 characters. Sign-in attempts are throttled. Two-factor authentication (authenticator app) is mandatory for Owners, Admins and our staff. Sessions are stored on the server, end after 30 minutes idle or 8 hours, and can be revoked.
Keys API keys and licence keys are shown once and stored only as keyed hashes. Keys have scopes and can be rotated or revoked. Site keys are public by design and can only read published files.
Secrets Two-factor secrets, webhook secrets, provider keys and store access tokens are encrypted at rest with key identifiers so keys can be rotated.
Customer separation Every database query is limited to the customer's own account and fails closed if the account is missing. Automated tests check isolation between customers.
Signed translations Published translation files are signed (Ed25519). The loader on your site checks the signature and file hashes before showing anything, and refuses older or forged files. A tampered file is ignored and your original text is shown.
Crawling and imports Our crawler cannot reach private networks or cloud metadata addresses, limits what it will download, and respects robots.txt unless you prove that you own the site. Webhooks cannot target private or local addresses.
Audit log Important actions are recorded in a tamper-evident, hash-chained audit log that you can read. Secrets are never written to it. IP addresses in it are truncated.
Logging Operational logs remove API keys, tokens, passwords, e-mail addresses and secret-looking values.
Our staff Support staff use a separate back-office with mandatory two-factor sign-in, roles, a recorded reason for every action and a tamper-evident log. Looking at your account on your behalf is read-only, limited to 30 minutes and visible in your own audit log.
Privacy by design The loader sets no cookies and sends no identifier. Translation files are plain static downloads.
Software supply chain Dependencies are pinned and checked, with a licence policy and automated code scanning.
Resilience Published translated pages do not depend on our dashboard being up: visitors load static files from your site or a CDN. Limits are explained on the trust page.

2. What you control

  • Turn on two-factor authentication for everyone on your team and give people the lowest role they need.
  • Keep secret keys secret. Revoke any key you think has been exposed.
  • Remember that published translations are public. Do not publish personal data or secrets.
  • Use the audit log and the usage page to notice anything unexpected.

3. What we have not done yet

We believe in telling you plainly:

  • We do not yet hold an independent security certification (such as ISO 27001 or SOC 2) or have a published third-party penetration-test report.
  • Encryption of the database and storage at rest depends on our hosting provider; we do not control it from our code.
  • The automated tests that check our security measures cover the code. They are not a replacement for an independent assessment.

4. Reporting a problem and incidents

Report security issues or suspected breaches to [OPEN: mailbox]. We will acknowledge your report, investigate and tell you what we find. If a personal-data breach affects your data, we notify you without undue delay and within 72 hours of becoming aware, as set out in the DPA. Please give us reasonable time to fix a problem before you make it public. We will not take action against good-faith reports.

Change log

Version date What changed
2026-11-05 First complete version for the public launch.