ARB EditorARB Diffl10n.yamlLocalesDateFormatBlogCLI DocsLogin

Security

Last updated: 17 October 2026

What we do to protect your translations and account data, stated plainly, including what we do not do yet. We hold no third-party security certification. The binding version of these measures is Annex 2 of our Data Processing Agreement.

Hosting

  • The API and its PostgreSQL database run on a dedicated server in France (EU) that we operate ourselves. No third-party cloud provider hosts the database.
  • The website and the dashboard are static files served by Google Firebase Hosting. They hold no customer data.
  • The database and cache listen only on the local machine and cannot be reached from the internet. A host firewall and fail2ban are active, and operating system security updates install automatically.

Encryption

  • Every public endpoint (website, dashboard, API) is served only over HTTPS with TLS. Email goes out through Brevo over TLS, and calls to Google and Stripe use TLS.
  • Passwords are stored as salted PBKDF2 hashes. Developer API tokens are stored only as SHA-256 hashes; the full token is shown once.
  • Access tokens for connected Git providers are never returned by the API and are deleted when you disconnect the integration. They are not yet encrypted at the application level, and the server disks are not encrypted. Use fine-grained tokens limited to your localisation repository.

Access control

  • Workspace roles, plus per-project and per-flavor access, decide what each team member can see and change.
  • Developer API tokens for the CLI, CI and the MCP server carry explicit scopes: strings:read, strings:write and translate. They can expire, can be revoked at any time, and record when and from which IP address they were last used.
  • The live update key embedded in shipped apps can only read published translations.
  • Administrative server access is limited to one named operator, uses SSH keys only, and root login is disabled.

AI translation

Only the strings, keys, placeholders and descriptions needed for a translation are sent to the Google Gemini API or Vertex AI. Account data is never sent.

Backups

The database is dumped every night and each dump is checked after it is written. We keep 14 daily copies plus 8 weekly copies. The backups are currently stored on the same server, so they protect against software errors and accidental deletion but not against the loss of the machine.

Deletion

When you delete your account in the dashboard, your workspaces, projects, translations, members, API tokens and Git integration tokens are removed from the live database at once and active subscriptions are cancelled. Backup copies age out within 8 weeks. Export your ARB files before you delete.

Incidents

If a personal data breach affects your data, we notify the workspace owner without undue delay and within 48 hours of becoming aware of it.

Responsible disclosure

If you find a vulnerability, email support@flutterlocalisation.com with the subject "Security report", a description, the steps to reproduce and the impact you see. Please:

  • test only against your own account and data, and stop as soon as you reach someone else's data;
  • avoid denial of service, spam, social engineering and physical attacks;
  • give us reasonable time to fix the issue before you disclose it.

We confirm receipt within 3 business days, keep you updated, and will not take legal action against research done in good faith within these rules. We do not run a paid bug bounty. Machine-readable contact details are in /.well-known/security.txt.

Questionnaires

We answer security and vendor questionnaires for customers and prospects. Send them to support@flutterlocalisation.com.