Where it runs
The dashboard and the API run on Heroku (Salesforce), on managed infrastructure with a managed PostgreSQL database. Application secrets are kept in that environment’s configuration, never in our code repository.
Payments are handled by Stripe. Card details go to Stripe directly and never reach our servers.
Encryption
Everything travels over HTTPS. A request made over plain HTTP is redirected rather than answered, and session and CSRF cookies are marked Secure, so a browser never sends them over an unencrypted connection. Browser requests are accepted only from the origins we configure, and forms only from our own domains.
At rest, the database is encrypted by our host, Heroku, which encrypts everything it writes to disk. The nightly backups are stored encrypted as well, in storage restricted to the EU.
Signing in
You sign in with a link or a six-digit code we email you, so there is no password to reuse or leak, though you can set one if you prefer. A link works for ten minutes and can be opened more than once in that time. That is deliberate: corporate mail scanners often follow links before you do, and a single-use link would already be spent by the time it reached you. The code is there for mail filters that rewrite links altogether. Sign-in requests are rate limited per address and per caller.
You can also sign in with Google or Microsoft. We ask the provider only for your address and whether it has verified it, and we keep the identifier it uses for your account, so that if your address changes later you still land in your own account rather than an empty new one.
Two-factor authentication works with any authenticator app, on every plan. Once it is on, every way in asks for it: password, emailed link, typed code and Google or Microsoft alike. Ten single-use recovery codes mean a lost phone is not a lost account, and a code cannot be replayed within its own 30-second window.
It is worth knowing why two-factor matters. Accounts are tied to an email address, so whoever administers that mailbox, such as your Google Workspace or Microsoft tenant admin, can complete a sign-in that ends there. Two-factor is what puts an account beyond them. A workspace can therefore encourage it, asking members without blocking anyone, or require it, in which case members without it can still read and export but cannot make changes. Only an admin who has two-factor can require it.
Who can see what
Access is set per workspace (owner, admin, developer, translator) and again per project (admin, editor, viewer). Belonging to a workspace does not by itself open every project in it, and being given one project cannot be turned into authority over the workspace.
Moving a project to another workspace needs admin rights over the workspace it is leaving, not just over the project, so a contractor with access to one project cannot walk off with it.
API keys, the CLI and MCP
An API key is stored only as a SHA-256 hash, which is why we can show it to you once and never again: we do not have it. Every key belongs to the person who created it, and every call made with it, through the REST API, the CLI or an MCP client, runs as that person and passes the same permission checks as the dashboard.
MCP clients such as Claude can connect over OAuth instead of using a long-lived key. Whichever route a change takes, it is recorded in the project’s history under the person behind it.
Your data stays yours
Export works on every plan, including Free, and keeps working after a trial or subscription ends. Going over a plan limit pauses editing but never blocks reading, exporting or deleting, so you can always take your data with you or bring a workspace back within its plan.
Every edit to a translation is recorded with the previous value and who made it, so an accidental overwrite can be traced and put back. A file import is recorded as a single event per file, without the values it replaced, and deleting a translation deletes its history with it.
You can delete your account yourself from Edit profile. You see exactly what will be deleted before anything happens, and you confirm through a link we email you, plus your second factor if it is on. Workspaces you own alone are deleted with the account; a workspace other people still use has to be handed over first.
Backups
The database is backed up every night to storage restricted to the EU. Each backup is checked to be readable before it is stored, and deleted automatically after seven days, so anything you delete is gone from our backups within a week.
Our host also keeps its own continuous copy of the database for disaster recovery, in the same region. We cannot restore from it ourselves; it exists for Heroku to recover the database if its infrastructure fails.
Vulnerabilities and patching
The website’s and the API’s dependencies are pinned to exact versions and watched by GitHub Dependabot, which alerts us when a published vulnerability affects a version we use. We patch critical vulnerabilities within 7 days of a fixed version being released, and high-severity ones within 30 days.
Application errors are reported to Sentry, a US service. Before a report leaves our servers or your browser, we remove request bodies, headers, IP addresses, query strings and variable values, and mask email addresses and the tokens in sign-in and invite links.
Security incidents
If a breach affects your data, we email the workspace owner without undue delay and in any case within 48 hours of becoming aware of it, early enough for your own 72-hour notice under the GDPR. We tell you what happened, which data is involved and what we are doing about it, and we keep you updated as we learn more.
This is a binding commitment in our Terms and in our Data Processing Agreement, which is part of the Terms on every plan and can be read at localizeme.app/dpa.
Reporting a problem
If you find something that looks wrong, email [email protected] with enough detail to reproduce it. We would much rather hear about it from you than not hear about it.