Security Overview

Babelize reads your repositories, so you should know exactly what we do with them. This is a summary; the full, current page is babelize.co/security. We are a small team and do not hold a SOC 2 or ISO 27001 certification yet.

Infrastructure

Your code

• Babelize reaches your repositories through the Babelize GitHub App, on the repositories you install it on. GitHub sign-in asks only for your profile and email.
• Accounts that signed in with GitHub before October 18, 2026 also granted repository access at sign-in. Babelize keeps that token encrypted and uses it only when the App can't reach a repository you imported into Babelize, for example an organization repository where the App isn't installed. To stop that, revoke Babelize under GitHub → Settings → Applications → Authorized OAuth Apps; Babelize then uses only the App. Details on Access control.
• Repositories are cloned to our servers to run a translation. Babelize pushes only to its own babelize/<branch> branch and opens a pull request; it never pushes to your existing branches.
• Only text strings, short context, glossary terms and brand voice go to translation models. Whole source files are never sent.
• We never use your code, strings or translations to train or fine-tune any model.

Secrets

• AI provider keys you bring (BYOK) and OAuth tokens, including GitHub App user tokens, are encrypted with AES-256-GCM.
• Babelize API keys are shown once and stored only as SHA-256 hashes, with optional expiry.

Access

• Sign in with email and password, GitHub or Google. Optional two-factor authentication (TOTP).
• Row-level security on every database table, enforced by an automated CI check.
• Webhooks from GitHub and Dodo Payments are signature-verified.

Report a vulnerability

Email security@babelize.co with details and steps to reproduce. We acknowledge reports within 48 hours. See our disclosure policy, including safe harbour for good-faith research.