Security and teams

Security and encryption

Details about EU-hosted processing, browser-side HPKE sealing, account security, upload validation, retention, and deletion.

DeepReference processes translations on its own EU-hosted application and model infrastructure rather than sending text to a third-party translation API. This article describes the controls used for browser traffic, accounts, uploads, storage, retention, and deletion.

Browser-to-server encrypted requests (HPKE)

Beyond TLS, supported JSON and text API traffic is sealed in your browser before it leaves. We use HPKE (RFC 9180), the IETF hybrid public-key encryption standard, with X25519 key agreement and AES-GCM: your browser encrypts each supported request to the processing server, and the server encrypts its response back to a fresh key that exists only in your browser tab. Multipart file-import workflows remain protected by TLS.

• Bound to its endpoint: each sealed message is cryptographically tied to the exact request it belongs to, so a captured blob cannot be replayed against a different endpoint or swapped between requests.
• Tamper-evident: a single flipped bit makes the message unreadable; modified traffic is rejected, never processed.
• Visible: the dashboard and both editors show an encryption badge while the envelope is active.
• Key rotation without breakage: server keys can be rotated with a grace period, so open sessions keep working.

Protecting your account

• Passwords are salted and hashed with Argon2. DeepReference does not store the readable password.
• Two-factor authentication with any authenticator app, plus one-time recovery codes. Set it up in account settings.
• New-device and new-location verification: a sign-in from an unknown device or country must be confirmed by a code sent to your email.
• Sign-in, registration, and password-reset endpoints are rate-limited and lockout-protected against guessing.

What happens to an uploaded file

Uploads are checked before processing. The file signature must match the declared type, archive-based formats (DOCX, XLSX, PPTX) are checked for unsafe expansion patterns, and PDFs with embedded JavaScript or automatic launch actions are rejected. Stored documents are isolated by account in access-restricted application storage. Disk and backup encryption are deployment controls that must be enabled and verified on the hosting system.

Where processing happens

The model runs on DeepReference servers in the EU. Cloudflare provides DDoS protection and traffic filtering in front of the application; the model, database, and cache are not exposed directly to the internet. Translation text is not sent to an external model provider. Administrative access supports an additional network gate as well as role checks. See the privacy policy and GDPR page for the formal terms.

Retention and deletion

Document retention is configurable in CAT settings. Documents, Translation Memory entries, glossaries, and termbase content can also be deleted individually. Account deletion starts removal of the account and its active workspace data; backup retention is described in the privacy documentation.

Where the security boundary sits

Translation content stays within the DeepReference service boundary instead of being forwarded to another model provider. Customer documents are used to provide the requested service and are excluded from model improvement unless the account owner opts in. The browser envelope follows RFC 9180, and passwords use Argon2; these are established standards rather than custom cryptographic designs.