Security
Security practices and policies for Better i18n.
Better i18n takes security seriously. This page outlines our security practices and how we protect your data.
Infrastructure
Hosting
- Cloudflare Workers - Edge computing with built-in DDoS protection
- Cloudflare R2 - Object storage for translation files
- PlanetScale - Serverless MySQL with automatic backups
Data Centers
Data is processed and stored on infrastructure operated by Cloudflare and PlanetScale. Those providers hold:
- SOC 2 Type II certification
- ISO 27001 certification
- GDPR compliance commitments
These are our providers' certifications, not ours. Better i18n's own SOC 2 Type II and ISO 27001 audits are in progress — see SOC 2 below. The distinction matters on a security page: a reader evaluating us should not have to infer whose certificate they are reading.
Authentication
API Keys
- API keys are hashed before storage (bcrypt)
- Keys can be scoped to specific projects
- Keys can be revoked instantly from the dashboard
- Rate limiting prevents brute force attacks
OAuth
- GitHub OAuth for dashboard access
- No passwords stored - delegated to OAuth providers
- Session tokens expire after 30 days of inactivity
Data Protection
Encryption
- In Transit: All connections use TLS 1.3
- At Rest: Database encryption using AES-256
Access Control
- Role-based access control (RBAC) at organization level
- Audit logs for all sensitive operations
- Principle of least privilege for internal access
Translation Data
What We Store
- Translation keys and values
- Namespace metadata
- Sync history and logs
What We Don't Store
- Source code (only translation files)
- Credentials or secrets
- Personal user data beyond what's needed for the service
GitHub Integration
Permissions
We request minimal GitHub permissions:
- Repository Contents: Read/write translation files only
- Pull Requests: Create PRs for translation updates
- Webhooks: Receive push events for sync
Data Flow
- We only access files matching your configured patterns (e.g.,
locales/**/*.json) - Translation files are synced to our database
- Updates are pushed back as pull requests
- You maintain full control over merging
Responsible Disclosure
If you discover a security vulnerability, please report it to:
We will:
- Acknowledge receipt within 24 hours
- Provide an initial assessment within 72 hours
- Keep you informed of our progress
- Credit you in our security acknowledgments (if desired)
Please do not disclose vulnerabilities publicly until we've had a chance to address them.
Compliance
GDPR
- Data processing agreements available
- Right to erasure supported
- Data export available on request
SOC 2 and ISO 27001
We run the controls both standards require. Neither certification is issued yet: the SOC 2 Type II audit and the ISO 27001 certification are in progress.
Wording here is deliberately the same as the landing site's, which was corrected on 2026-08-03 after a competitor's counsel wrote to us about unsourced claims on our comparison pages. Claiming a certificate we do not hold would be that same mistake aimed at ourselves, and a security page is the worst place to make it.
Questions?
For security-related questions, contact us at [email protected].