Technical and organisational measures

The security measures behind our Data Processing Agreement, in the order GDPR Article 32 asks about them. It lists what is in place today and what isn’t, so you can judge for yourself.

• Premises: the servers stand in Hetzner’s data centre in Falkenstein, Germany, certified to ISO/IEC 27001. Nobody at Transept has physical access.
• Systems: two named people, the founders, can log in to production. Administrator login accepts SSH keys only, and a firewall closes every port the service doesn’t use.
• Data: nobody reads customer documents in routine work. For a support request we ask your permission and which document before opening it. Admin actions on accounts (role changes, impersonation, credit adjustments) are written to a permanent audit log.
• Separation: each account sees only its own documents and the ones shared with it. Team documents are visible to that team only.

• In transit: TLS 1.2 or higher on every connection, between your browser and our servers and between our servers and the AI providers. Plain HTTP is redirected.
• Passwords and codes: stored only as salted bcrypt hashes. One-time codes expire after ten minutes and are hashed the same way.
• At rest: the server’s disk and the backups on it are not encrypted by us. They are protected by the data centre’s physical security and by the access limits above.

• Server logs record requests and errors, never the text of your documents, and are kept for up to 90 days.
• AI request records (model, timing, token counts, cost, errors) sit on our own monitoring server in Germany. Prompt and reply text is masked before it is stored.
• Document history: every change to a translation, by a person or by the AI, is recorded with who made it, so you can see who wrote what.

• The database is copied before every software update; the ten most recent copies are kept in Germany.
• A failed database change stops the update and leaves the running version and its data untouched.
• Restoring from these copies has been done in production, not only tested.
• Each update is health-checked as soon as it starts.

Deleting a document removes it and its translations from the database at once; deleting an account removes everything in it. Backup copies are replaced within about two days. Records at the AI providers follow their own retention, listed in the Data Processing Agreement.

• A model receives the passage or page being worked on, for the length of the request.
• Every provider we use excludes API data from model training.
• The full list, with regions and the transfer terms for each, is on the sub-processors page.

We investigate every suspected breach at once, tell affected customers without undue delay and within 72 hours, and notify the supervisory authority where the law requires it. Report a vulnerability to support@transept.ai.

• An automated test suite runs on every change before it ships.
• We review a sub-processor’s terms before adding it, and this page when anything above changes.

• No SOC 2 report and no ISO 27001 certificate of our own.
• No external penetration test so far.
• No encryption at rest beyond the data centre’s own controls.
• Backups are kept on the production server, not at a second site.