Security whitepaper

This document provides a comprehensive overview of how Langbly protects customer data. It covers infrastructure, encryption, authentication, data flow, access controls, incident response, and GDPR compliance.

For a shorter summary, see Security and data handling.

Architecture Overview

Every translation request flows through a simple, stateless path:

1. Client request arrives over TLS 1.3 at the API endpoint
2. Authentication — the API key is verified against the key management service
3. Rate limiting — request volume is checked against plan limits
4. Translation — text is sent to the translation engine
5. Response — translated text is returned to the client
6. Limited retention — source text is discarded; eligible translated responses may be cached temporarily

Text requests are processed synchronously. Eligible translated responses may be cached for up to one hour; responses stored under an idempotency key may be retained for up to 24 hours. Document translation is asynchronous and its result is available for up to 24 hours.

Endpoints

Endpoint	Region	Use case
api.langbly.com	Global service route	Global access
eu.langbly.com	EU data residency route	Processing and temporary storage in the EU

Both endpoints use the same codebase, authentication and billing. The EU endpoint routes translation processing through EU regions.

Encryption

In transit

All API traffic uses TLS 1.3. Connections using older TLS versions or plaintext HTTP are rejected at the edge. There is no option to downgrade or bypass encryption.

API keys are transmitted in the X-API-Key header (recommended) or as a query parameter. Header-based transmission is preferred because query parameters may appear in server logs and browser history.

At rest

Account data (email, name, billing information) and usage metrics are encrypted at rest using AES-256. Encryption is handled by the cloud provider's managed encryption service with automatic key rotation.

The current Redis cache is protected with TLS in transit. Encryption at rest for that cache is not included in the current Upstash pay-as-you-go configuration, so it must not be claimed as active.

Authentication

API keys

Every API request requires a valid API key. Keys are verified on each request through a dedicated key management service that handles:

• Key validation and lookup
• Per-key rate limiting
• Usage tracking per key

Customers can create multiple API keys per account and revoke them independently. Key revocation takes effect immediately.

Dashboard access

The Langbly dashboard uses email/password authentication with secure session management. Sessions expire after a period of inactivity.

Data Handling

Limited content retention

Langbly minimizes content retention and documents the exceptions:

• Request bodies (source text) are not written to application databases or logs
• Eligible translated responses may be cached in Redis for up to one hour
• Responses stored under an idempotency key may be retained for up to 24 hours
• Document-translation results are available for up to 24 hours
• Customer content is never used for model training

What we do store

Data type	Purpose	Retention
Account info (email, name)	User management	Duration of account
Billing data	Invoicing via payment provider	As required by law
API keys (hashed)	Authentication	Until revoked
Usage counters	Billing, rate limiting	Duration of account
Request metadata	Monitoring, debugging	30 days
Eligible translated response	Repeat-request cache	Up to 1 hour
Idempotent API response	Safe request replay	Up to 24 hours
Document result	Customer download	Up to 24 hours

Request metadata includes timestamp, language pair, character count, and response time. It does not include the actual text content.

What we do not persist to application databases or logs

• Source text submitted for text translation
• Translation content in monitoring and billing logs

No-Training Policy

Langbly does not use customer data to train, fine-tune, or improve any models. This is a permanent, unconditional policy.

Your translation content is processed and discarded. It is not aggregated, analyzed, or used for any purpose beyond fulfilling your specific API request.

Network Security

Infrastructure isolation

Requests are logically isolated by authentication and account scope. Key properties:

• API keys and account authorization are checked on each request
• Account-specific cache variants include the options that affect output
• The cross-account cache is only used for requests without glossaries, custom instructions, context, instruction sets or account translation memory
• Cache keys contain hashes rather than readable source text

DDoS protection

API endpoints sit behind a global CDN and DDoS mitigation layer that filters volumetric and application-layer attacks before they reach the origin servers.

Rate limiting

Rate limits are enforced per API key through the key management service. Limits vary by plan tier and are designed to prevent abuse without impacting legitimate usage.

Access Controls

Principle of least privilege

Production infrastructure access follows strict least-privilege principles:

• Only the operator has direct access to production systems
• No shared credentials or service accounts for human access
• All infrastructure changes are deployed through version-controlled pipelines
• Administrative access is authenticated and logged

Dependency management

Dependencies are managed through lockfiles and updated regularly. Security advisories for dependencies are monitored and patched promptly.

Incident Response

Detection

Automated monitoring checks both API endpoints every minute. Health checks verify:

• API endpoint availability
• Database connectivity
• Cache availability
• Translation engine responsiveness
• Response time percentiles

Alerts fire within 5 minutes of detecting an issue.

Response process

Phase	Target	Action
Detection	< 5 minutes	Automated monitoring detects the issue
Triage	< 15 minutes	Determine severity and impact
Initial response	< 30 minutes	Begin investigation, update status page
Resolution	< 4 hours	Restore service to normal operation
Post-mortem	< 5 business days	Root cause analysis shared with affected customers

Data breach notification

If a data breach occurs, affected customers are notified within 72 hours as required by GDPR Article 33.

Because Langbly does not store translation content, the potential scope of any breach is limited to account metadata (email, name, billing data) and API keys. There is no corpus of customer translations that could be exposed.

EU Data Residency

Customers requiring EU data residency can use eu.langbly.com. On this endpoint:

• Requests enter through Cloudflare's global edge network
• Vertex AI processing uses Google Cloud regions in EU member states
• europe-west4 in the Netherlands is the configured default, not the only EU region
• The database is in the EU
• The temporary Redis cache is in Frankfurt, Germany (eu-central-1)

For full details, see EU Data Residency.

GDPR Compliance Mapping

The following maps Langbly's practices to specific GDPR articles:

Article 5 — Principles

Principle	How Langbly complies
Lawfulness, fairness, transparency	Processing based on contractual necessity. Privacy policy and DPA publicly available.
Purpose limitation	Data processed exclusively for providing translation services and billing.
Data minimization	Source text is excluded from application databases and logs. Eligible results use the documented one-hour or 24-hour retention windows.
Accuracy	Customers control their account data and can update it at any time.
Storage limitation	Eligible results use short documented retention windows. Account data is kept for the duration of the account.
Integrity and confidentiality	TLS in transit, managed encryption at rest for account data, logical tenant isolation and access controls.

Article 6 — Lawfulness of Processing

Langbly processes personal data on the basis of contractual necessity (Article 6(1)(b)). The customer submits data for translation, and Langbly processes it to fulfill that request.

Article 25 — Data Protection by Design and by Default

Short retention windows and the exclusion of source text from application databases and logs are data-minimization measures by design.

Article 28 — Processor Obligations

Langbly acts as a data processor on behalf of the customer (data controller). A Data Processing Agreement (DPA) is available at langbly.com/dpa.

Sub-processors:

Sub-processor	Purpose	Location
Google Cloud Platform	Translation model processing and document services	Global service route; EU data residency route
Cloudflare	API edge, DNS and DDoS protection	Global
Supabase	Account database and authentication	EU (Frankfurt)
Upstash	Temporary response cache	EU (Frankfurt)
Stripe	Payment processing	United States (with EU SCCs)

Article 32 — Security of Processing

See the Encryption, Network Security, and Access Controls sections above. Measures include:

• TLS 1.3 for all data in transit
• Managed encryption at rest for account data and usage metrics
• Logical tenant isolation
• Least-privilege access controls
• Automated monitoring and alerting

Article 33 — Breach Notification

Langbly notifies the relevant supervisory authority within 72 hours of becoming aware of a breach. Affected customers are notified without undue delay.

Articles 15-22 — Data Subject Rights

Customers can exercise the following rights by contacting hello@langbly.com:

• Right of access (Art. 15): Request a copy of stored personal data
• Right to rectification (Art. 16): Correct inaccurate account data
• Right to erasure (Art. 17): Request deletion of account and all associated data
• Right to restriction (Art. 18): Restrict processing of personal data
• Right to data portability (Art. 20): Receive account data in a structured format
• Right to object (Art. 21): Object to processing of personal data

Translation content cannot be subject to these requests because it is not stored.

Audits

Langbly makes available to customers all information necessary to demonstrate compliance with GDPR Article 28. Customers may conduct audits of Langbly's data processing practices, subject to reasonable advance notice (30 days) and scheduling during business hours.

Contact

For security questions, vulnerability reports, or compliance inquiries:

• Security issues: security@langbly.com
• General inquiries: hello@langbly.com
• DPA requests: langbly.com/dpa