Data security
What happens to your clients' documents
Agencies sign NDAs and carry the liability. This is exactly where a scan goes, who can see it and when it is deleted, written as facts rather than reassurance.
6,000 free characters to start, then topped up to 1,000 every month, no card. See real scans translated, with their Word files
Translation agencies we work with
The path of a document
- Storage
- Files and the database live with Hetzner Online GmbH in the European Union (Germany / Finland), and the database is backed up daily on the same server, each copy kept 7 days. Their data centres are ISO 27001 certified.
- Recognition and translation
- Page images (for recognition) and text (for translation and AI checks) are sent through OpenRouter to model providers with training switched off. OpenRouter is a US company, so this is a transfer outside the EU.
- Model training
- Your documents are not used to train models: neither by us nor by the model providers, who are selected with training disabled.
- Retention
- Auto-delete is on by default: 30 days after upload the document, its translation and the stored files are permanently removed. You can shorten, extend or turn this off. Deleting a document by hand removes it immediately; the copy in the daily database backup rolls off within 7 days.
- Who can see it
- Nobody on our side opens a document unless you ask support to, for example to reproduce a problem.
- In transit
- TLS 1.2+ on every connection to our servers; inside the server the services talk over a private network. Passwords are stored as bcrypt hashes.
- Error monitoring
- Errors go to Sentry as the error type and where it happened. Request bodies and variables are never sent, and quoted text is cut out of error messages before they leave the server.
What we will not claim
- We have no ISO 27001 or SOC 2 certificate of our own. The certification belongs to the data centre.
- Text and page images leave the EU for recognition and translation. If your client forbids any transfer outside the EU, this tool is not for that client.
- There is no on-premise or air-gapped version.
The documents behind this page
Questions
Is there a data processing agreement?
Yes, the DPA is published and applies to every account. If your client needs a signed copy, write to us.
Can we delete everything at once?
Delete documents in the app, or email help@chatscontrol.com and we delete the account's data on request.
Where is the list of subprocessors?
On the subprocessors page, with the purpose and country of each one.
More for agencies
Put one of your own scans through it
A certificate, a diploma, a form with a table. You will see in two minutes whether it saves your team time.