Security
How your translations are handled
Translation strings are product copy, not customer records — but they sit in your release pipeline, and the keys that reach them are real credentials. This page says plainly what LocalizeMe does about that, and what it does not do yet.
In transit
- Every request is served over HTTPS; plain HTTP is redirected, not accepted.
- Session and CSRF cookies are marked Secure, so a browser will not send them over a plain connection.
- Browser requests are accepted only from the origins we configure, and form POSTs only from our own domains.
Signing in
- Sign-in is by emailed link or short code, so there is no password to reuse or leak. You can set one if you prefer.
- Sign-in requests are rate limited per address and per caller.
- A sign-in link is good for ten minutes and can be opened more than once in that window. That is deliberate: corporate mail scanners follow links before you do, and a single-use link would already be spent by the time it reached you. Every email also carries a six-digit code, for tenants whose filters rewrite links entirely.
- Two-factor authentication with any authenticator app, on every plan. Once it is on, every way in asks for it — password, emailed link and typed code alike.
- Ten single-use recovery codes, so a lost phone is not a lost account. A code cannot be replayed inside its own 30-second window.
- A workspace can encourage two-factor — members are asked and nothing is blocked — or require it, where members who have not set it up keep reading and exporting but cannot make changes. Only an admin who already has it can require it.
API keys and MCP
- An API key is stored only as a SHA-256 hash. We cannot show you the key again after you create it, because we do not have it.
- Keys are scoped to the user who created them: every REST and MCP call runs as that user and passes the same permission checks as the dashboard.
- MCP clients can authenticate over OAuth instead of pasting a long-lived key.
- Every write is attributed to the user behind the key in the project activity history.
Who can see what
- Access is per workspace (owner, admin, developer, translator) and again per project (admin, editor, viewer) — being in a workspace does not grant access to every project in it.
- Granting someone access to one project cannot escalate their authority over the workspace.
- Moving a project to another workspace takes admin authority over the workspace it is leaving — administering the project alone is not enough, so a contractor cannot walk off with it.
Your data stays yours
- Export works on every plan, including Free, and including after a trial or subscription ends. Your strings are never held hostage.
- Going over a plan limit pauses editing but never blocks reading, exporting or deleting — so you can always get your data out or shrink back into the plan.
- Translation changes are recorded with the previous value, so an accidental overwrite can be traced and recovered.
- You can delete your account yourself from account settings, confirmed by email.
Where it runs
- The API and the dashboard run on Heroku (Salesforce), on managed infrastructure with a managed PostgreSQL database.
- Application secrets live in environment configuration, never in the repository.
- Payments are handled by Stripe. Card details go to Stripe directly and never reach our servers.
Not in place yet
LocalizeMe holds no security certification, and does not offer SAML single sign-on. If your procurement process requires either, tell us what you need and we will tell you honestly where it sits rather than claim it here.
Reporting a problem
Found something that looks wrong? Email [email protected] with enough detail to reproduce it. We would rather hear about it from you than not hear about it.