Trust and Security: What happens to your content
Secure. Transparent. Responsible. Trusted.
Sending content you can't take back is a real risk when you don't know where it goes next. On MachineTranslation.com, content is encrypted in transit and at rest, deleted on the schedule below, and not used to train any AI model. Every statement on this page shows its status and the date it was checked.
- Maintained by Shashank Jain, Tech Lead.
- Last reviewed October 26, 2026.
- Security questions: security@machinetranslation.com
Why this page exists
In an internal Tomedes survey of enterprise clients, 92% ranked confidentiality as their top concern. In follow-up surveys, 91% of respondents put data security and control ahead of raw speed (Tomedes survey write-up).
AI models disagree with each other, so trusting one model with content that matters is a risk. MachineTranslation.com compares the outputs of 22 AI models and returns the translation most of them agree on. For content that must stay in a controlled environment, Secure Translation keeps processing inside MachineTranslation.com's own AWS environment. This page shows how content is handled around both.
At a glance
- Company: Tomedes LLC
- Platform: MachineTranslation.com
- Core services: AI translation across 22 AI models, large file translation with layout preservation, human verification, developer API, MCP integration, and Secure Translation mode for sensitive content.
- Hosting infrastructure: AWS, US East (N. Virginia) region, with auto-scaling and failover.
Security overview
Application and data security
| Control | Implementation |
|---|---|
| Encryption in transit | TLS 1.3 with HSTS; all user traffic is HTTPS |
| Encryption at rest | AES-256 encryption for stored content and logs |
| Secure development practices | OWASP Top 10-aligned secure SDLC; SAST and code reviews |
| User authentication | Secure session management |
| Penetration testing | Third-party testing twice a year and monthly internal scans |
| Access controls | RBAC; email-based MFA with re-authentication every 30 days; quarterly privilege reviews |
| Logging and auditing | Full user and admin activity logging; audit trail kept for 6 months |
Platform integrity and availability
| Aspect | Detail |
|---|---|
| Uptime SLA | 99.9% for enterprise users |
| Disaster recovery | Daily encrypted backups, stored in the US East (N. Virginia) region |
| Monitoring | 24/7 alerting on health, latency and AI model failures |
| Segment analysis | Segment scores show how strongly the AI models agreed on each translated segment |
| Translation output scoring | MachineTranslation.com scores each segment by how many of the 22 AI models agree and selects the translation the majority agree on. |
Privacy and responsible AI
Data usage and protection
| Policy area | Status and description |
|---|---|
| Data minimization | Only necessary data is collected and processed |
| AI training | MachineTranslation.com does not train AI models on translations, and each AI model provider is used under settings or paid plans that exclude training. |
| Retention: unregistered users | Default auto-deletion after 6 months |
| Retention: registered accounts | Uploaded files are auto-deleted after 30 days. Text is kept in the user's account until the user deletes it or requests deletion |
| Delete anytime | Registered users can delete their translations anytime in their account. All users can request immediate deletion from active systems. Encrypted backup copies are overwritten on the normal backup cycle |
| Temporary access links | Translation URLs generated by unregistered users expire after 20 minutes and are then permanently invalidated |
| User consent | Explicit opt-in is required for data sharing with third-party MT providers |
| De-identification | No persistent identifiers are stored with translation data from unregistered users |
Secure Translation
Secure Translation is the mode for sensitive content, including protected health information (PHI). When it is switched on:
- text and files are processed and stored only within MachineTranslation.com's own AWS environment;
- content is never sent to third-party AI or MT providers;
- content is encrypted in transit (TLS 1.3) and at rest (AES-256).
Users must switch Secure Translation on before submitting sensitive content. For healthcare organizations using a registered business account, a Business Associate Agreement (BAA) covering Secure Translation is available on request.
Human verification
For content where accuracy is critical, a professional translator reviews and verifies the translation. Linguists work under NDA and receive only the content they are asked to review.
Ethical AI and machine translation use
Responsible use matters most for sensitive or regulated content. For high-risk domains such as legal and healthcare, human post-editing (MTPE) is recommended. Removing personal identifiers that are not needed for the translation is also recommended.
Human post-editing is not covered by the BAA, so patient identifiers should be removed before requesting human review of healthcare content.
For prohibited uses, see Section 2.3 of the terms and conditions.
Compliance & Documentation
| Framework / Report | Status | Notes |
|---|---|---|
| GDPR | ✅ Compliant | Privacy Policy updated for GDPR |
| HIPAA | ✅ Aligned | Secure Translation is designed in line with HIPAA guidelines. No official HIPAA certification exists; BAA available on request for registered business accounts |
| CCPA | ✅ Aligned | Privacy practices designed in line with the California Consumer Privacy Act |
| PIPEDA | ✅ Aligned | Privacy practices designed in line with Canada's PIPEDA |
| SOC 2 Type II | 🔄 In Progress | Report not yet available |
| ISO/IEC 27001 | ⬜ In Planning | Rollout begins 2027 |
| DPIA & PIA | ✅ Complete | Last updated: March 2026 |
| Vulnerability Disclosure Policy | ✅ Active | Public submission form available |
Available on request (under NDA)
- Data Processing Addendum (DPA)
- DPIA and PIA
- Business Associate Agreement (BAA) for Secure Translation
- Security whitepaper
Requests: security@machinetranslation.com. Consider publishing the DPA directly. The current list of sub-processors is on the Sub-processors page.
AI model providers: compliance, as of October 2026
Applies to standard translation mode only. Secure Translation does not send content to any of these providers. Based on each provider's official pages as of October 2026, providers may change their practices, so check the linked sources. "Yes" means confirmed on the provider's official pages. "Not published" means not publicly documented.
| Provider | GDPR | ISO 27001 | SOC 2 |
|---|---|---|---|
| Amazon Translate | Yes | Yes | Yes |
| DeepL (Pro/API) | Yes | Yes | Yes |
| Google Cloud Translation API | Yes | Yes | Yes |
| Microsoft Translator (Azure) | Yes | Yes | Yes |
| OpenAI API | Yes | Yes | Yes |
| Claude (Anthropic) API | Yes | Yes | Yes |
| Gemini API (Google) | Yes (paid tier) | Not published | Not published |
| Mistral AI | Yes | Yes | Yes |
| Grok API (SpaceXAI LLC) | Yes | Not published | Yes |
| Qwen (Alibaba Cloud Model Studio) | Not published | Not published | Yes |
| mBART via Hugging Face | Yes (Enterprise DPA) | Not published | Yes |
| ModernMT | Yes | Not published | Not published |
| Lingvanex | Yes | Not published | Not published |
| LibreTranslate | Depends on deployment | Not published | Not published |
| DeepSeek | Partial (data stored in China) | Not published | Not published |
| NiuTrans | Not published | Not published | Not published |
| RoyalFlush | Not published | Not published | Not published |
| AI21 Labs (Jamba) | Yes | Not published | Yes |
| Amazon Nova (Amazon Bedrock) | Yes | Yes | Yes |
| Meta Llama (Llama API) | Not published | Not published | Not published |
| Moonshot AI (Kimi) | Not published | Not published | Not published |
| Z.ai (GLM) | Not published | Not published | Not published |
AI model providers: data practices (API), as of October 2026
| Provider | Data use and retention | Source |
|---|---|---|
| Amazon Translate | May store text to provide the service and, unless the customer opts out via an AWS AI-services opt-out policy, to improve Amazon Translate. MachineTranslation.com has opted out. API activity can be logged with AWS CloudTrail | AWS Translate FAQ |
| DeepL (Pro/API) | Text processed to deliver the translation; not stored or used for training on paid plans. Only glossaries or translations the user saves are kept, until deleted | DeepL Data Security |
| Google Cloud Translation API | Text held briefly in memory to translate; not used to train or improve Google's models or for any other purpose | Google Cloud Data Usage |
| Microsoft Translator (Azure) | Submitted text is not stored (No Trace). Document translation keeps files only while processing, then permanently deletes them. Not used for training | Microsoft No Trace |
| OpenAI API | Not used for training by default. Abuse-monitoring logs kept up to 30 days; Zero Data Retention available to approved customers | OpenAI: Your Data |
| Claude (Anthropic) API | Inputs and outputs deleted within 30 days; not used for training by default. Content flagged for policy violations kept up to 2 years. Zero Data Retention available by agreement | Anthropic Privacy Center |
| Gemini API (Google) | Paid tier: not used for training; logged 55 days for abuse monitoring only. MachineTranslation.com uses the paid tier only | Gemini API Terms |
| Mistral AI | Inputs and outputs kept 30 rolling days for abuse monitoring unless Zero Data Retention is approved. Pay-as-you-go customers can opt out of training; MachineTranslation.com has opted out | Mistral Privacy Policy |
| Grok API | Requests and responses stored 30 days for abuse auditing; not used for training without permission. Zero Data Retention optional | xAI Security FAQ |
| Qwen (Alibaba Cloud Model Studio) | Customer data not used for model training; retention period not published | Alibaba Cloud Privacy Notice |
| mBART via Hugging Face | Payloads sent to Inference Endpoints not stored; logs kept 30 days | Hugging Face Security |
| ModernMT | Retention terms not publicly documented | ModernMT Privacy |
| Lingvanex | Data deleted immediately after translation; not used for training | Lingvanex Translation API |
| LibreTranslate | Hosted API does not store or log translation text; IP addresses kept 2 days for abuse prevention | LibreTranslate Privacy |
| DeepSeek | Data stored in China and kept while the account exists; inputs may be used for training, with opt-out by email | DeepSeek Privacy Policy |
| NiuTrans | Not publicly documented | – |
| RoyalFlush | Not publicly documented | – |
| AI21 Labs (Jamba) | Not used to train AI21's general models; API data handled under the customer agreement and DPA | AI21 Privacy Policy |
| Amazon Nova (Amazon Bedrock) | Prompts and outputs are not shared with model providers or used to train models | Amazon Bedrock Security & Privacy |
| Meta Llama (Llama API) | Meta does not train its models on Llama API customer content; retention period not published | Llama API Data Commitments |
| Moonshot AI (Kimi) | Data stored in Singapore; policy allows content to be used to improve models; no API-specific retention period published | Kimi Platform Privacy Policy |
| Z.ai (GLM) | API content is processed in real time and not stored on Z.ai servers | Z.ai Privacy Policy and DPA |
Key metrics
| Metric | Value |
|---|---|
| System uptime | 99.96% over the last 12 months |
| Backup frequency | Daily encrypted snapshots |
| Recovery point objective | 5 minutes or less |
| Incident response target (P1) | Under 2 hours |
Get in touch
| Inquiry type | Contact |
|---|---|
| Security questions | security@machinetranslation.com |
| Report a vulnerability | https://www.machinetranslation.com/contact-us |
| Business or legal inquiries (including BAA requests) | contact@machinetranslation.com |
Frequently asked questions
Does MachineTranslation.com use my translations to train AI models?
No. MachineTranslation.com does not train AI models on translations, and each AI model provider is used under settings or paid plans that exclude training. The data practices table lists the terms for each provider.
What is Secure Translation, and when should I use it?
Secure Translation is a mode for sensitive content, including protected health information. When it is switched on, text and files are processed only inside MachineTranslation.com's own AWS environment and are never sent to third-party AI or MT providers. Users must switch it on before submitting sensitive content.
How long is my content kept?
Content from users without an account is deleted automatically after 6 months. For registered accounts, uploaded files are deleted after 30 days, and text stays in the account until the user deletes it. Any user can request immediate deletion from active systems; encrypted backup copies are overwritten on the normal backup cycle.
Which companies handle my data?
The Sub-processors page lists each company that may handle personal data, what it does and where it is based. In standard mode, text goes to the AI model providers listed there. Account and payment details do not.
Recent updates
| Date | Update | Status |
|---|---|---|
| 2026-10-26 | Trust Center update: Secure Translation, HIPAA and third-party AI model details | Published |
| 2025-03-12 | Infrastructure failover upgrade | Completed |
| 2025-03-06 | Privacy policy revamp (GDPR) | Published |
| 2024-09-10 | Translation AI model bug (Amazon) | Resolved in 4 hours |
For incident and maintenance alerts, contact security@machinetranslation.com.