Security / trust page — Tolgee

Cited by

Facts read from this source

• ISO 27001 Report an error

  “Tolgee is ISO 27001 certified, and we invest heavily in people, processes and technology to safeguard the content our customers entrust to us.”

• Selfhosted privacy Report an error

  “If you host Tolgee yourself, you stay in full control — we don’t see your projects, users or logs.”

• Cloud 2FA Report an error

  “Two-factor authentication is optional but encouraged.”

• Cloud card handling Report an error

  “Payment cards are handled safely by our payment partner; we never see or store full card numbers.”

• Analytics Report an error

  “We also use PostHog (EU) for anonymised product analytics and Sentry (EU) for error reporting.”

• Providers Report an error

  “We host the Tolgee SaaS on Microsoft Azure and Amazon Web Services (AWS) infrastructure. Azure provides our core compute and databases, while AWS is used for object storage and sending transactional emails.”

• Certifications encryption Report an error

  “Both providers hold ISO 27001 and SOC 2 certifications, encrypt data at rest and in transit, and operate data centres in the EU and US.”

• Payment stripe Report an error

  “Tolgee uses Stripe, which stores and protects payment information.”

• Machine translation Report an error

  “For optional machine‑translation features, we integrate ChatGPT, AWS Translate, Google Translate and DeepL.”

• AI training Report an error

  “Tolgee does not use customer data to train AI models.”

• Llm API policy Report an error

  “Tolgee selects LLM providers whose API policies state that data submitted via their APIs is not used to train their models.”

• Encryption Report an error

  “Tolgee encrypts all network traffic using HTTPS/TLS.”

• Encryption at rest Report an error

  “Tolgee’s SaaS uses AES‑256 encryption for databases, file storage and backups, and we manage keys using industry‑standard key‑management systems.”

• SSO Report an error

  “Single Sign‑On & SAML – Tolgee supports OAuth 2.0 for single sign‑on.”

• MFA totp Report an error

  “Tolgee provides optional TOTP‑based 2FA and recommends enabling it for all accounts.”

• Rbac Report an error

  “Role‑Based Access Control (RBAC) – Tolgee implements fine‑grained project and organization‑level permissions.”

• Deletion Report an error

  “When you delete a project or account, data is permanently removed from production systems within 7 days and from backups within 7 days.”

• Dependency scanning Report an error

  “We use Snyk to scan dependencies for vulnerabilities and promptly apply security patches.”

• Pentesting Report an error

  “We use automated tools for penetration testing and partner with penetration testers who test the Tolgee platform.”

• Environment separation Report an error

  “Tolgee’s production instance is separated from development and staging.”

• Backups Report an error

  “Tolgee continuously backs up data in geographically diverse locations. We retain backups for at least 7 days; data can be restored quickly after a disaster.”

• Logging Report an error

  “We maintain extensive logging of system events, API calls and administrative actions. Logs are stored securely and monitored for anomalies.”

• Selfhosted responsibility Report an error

  “When self‑hosting, you are responsible for the security of the environment.”

• GDPR Report an error

  “GDPR – Tolgee complies with the EU General Data Protection Regulation. We minimise personal data, honour user rights (access, rectification, deletion and data portability) and store data in EU data centres whenever feasible.”

• Vulnerability disclosure Report an error

  “Vulnerability disclosure programme – We welcome security researchers. To report a vulnerability, please contact security@tolgee.io with details.”

• Security contact Report an error

  “For security or privacy questions, contact security@tolgee.io.”

• DPA Report an error

  “Data Processing Agreement – available on request for enterprise customers.”

• Selfhosted license usage Report an error

  “License usage data – for licensed self-hosted instances, we receive key count, seat count and string count to validate the license.”

• Selfhosted telemetry Report an error

  “Anonymous telemetry – optional stats (like number of projects, users or translations) that help us improve Tolgee. You can turn this off anytime in your settings.”

• Subprocessor DPA Report an error

  “When we need to use sub‑processors, we only engage vendors that meet stringent security requirements and sign Data Processing Agreements.”

• Selfhosted smtp Report an error

  “On a self-hosted instance, you configure your own SMTP server.”

• Effective date Report an error

  “Valid from September 29, 2025”

• Employee access Report an error

  “Employee access is restricted to what is necessary for their role. We log administrative actions and review permissions regularly.”

Scores citing this record

• The App Developer Machine translation & AI quality
• The App Developer Translation memory, terminology & review workflow
• The App Developer Confidentiality of translated content
• The App Developer European sovereignty
• The Data Protection Officer Machine translation & AI quality
• The Data Protection Officer Confidentiality of translated content
• The Data Protection Officer European sovereignty
• The In-House Document Translator Machine translation & AI quality
• The In-House Document Translator Confidentiality of translated content
• The In-House Document Translator European sovereignty
• The E-Commerce Marketer Machine translation & AI quality
• The E-Commerce Marketer Confidentiality of translated content
• The E-Commerce Marketer European sovereignty
• The Localization Manager Machine translation & AI quality
• The Localization Manager Confidentiality of translated content
• The Localization Manager European sovereignty
• The Skeptic Machine translation & AI quality
• The Skeptic Translation memory, terminology & review workflow
• The Skeptic Confidentiality of translated content
• The Skeptic European sovereignty