Do not take our word for it
Every translation vendor says your documents are safe. Here is what we claim, and next to each claim, the thing you can do to check it yourself.
What you can verify
Your documents are unreadable to everything between you and us
Files and text are sealed inside your browser with HPKE (RFC 9180) before they are sent, and only our servers hold the key to open them. Our own CDN carries ciphertext. So does every network in between, and anyone able to observe them.
Check it
Open your browser's developer tools, go to the Network tab, and translate something. The request body is not readable text. Then try to send one without the seal — the server refuses it.
curl -X POST https://www.deepreference.com/api/analytics/event \
-H 'Content-Type: application/json' -d '{}'
# 426 Upgrade Required — an unsealed request is rejected at the doorThe model runs on our own machine
The translation model is reached at a loopback address on the same server that holds your document. There is no third-party AI service or inference API anywhere in the path. Your text is never sent to another company to be translated.
Check it
Ask us for a live packet capture or a screen share of the server's outbound connections during a translation. There is nothing to see, which is the point.
Your documents are not training data
We never train our models on your content. Nothing you upload is used to train or improve them. Our own training uses public institutional texts, such as UN documents, and material we created and reviewed.
Check it
Your account settings have no training switch, because there is nothing to opt into.
We do not keep what we do not need
Documents, their translations and their segments belong to your account and are removed when you delete them. Analytics is cookieless and stores a salted daily hash instead of an identifier, so a visitor cannot be followed from one day to the next.
Check it
Delete a document and ask us to confirm it is gone from storage and from backups on the next cycle.
Who else is involved
These are the only outside parties in the path, and what each of them can actually see. None of them can read a document.
| Service | Why it is there | What it can see |
|---|---|---|
| Cloudflare | Network delivery, TLS, and protection against attack | Encrypted request bodies, addresses and timing. Not document content. |
| Stripe | Payments and invoicing | Your billing details. Never a document, never translated text. |
| Email delivery | Account, verification and receipt emails | Your email address and the message we send you. |
| Google Sign-In | Optional way to sign in | Only used if you choose it, and only your identity — never your work. |
| Cloudflare Turnstile | The human check on text translation and document upload | A signal about the browser, when you translate text or upload a document. |
What procurement usually asks for next
A data processing agreement, a completed security questionnaire, the retention and deletion schedule, or a call with whoever runs the infrastructure. Ask and you will get them — the person who built it will answer.
Ask usWe name certifications only once they have been awarded, and describe only what is running today. If something on this page stops being true, it comes off the page.