Why this is your question, not only ours
Under the GDPR, the one primarily responsible for the client's data is whoever decides why and how it is processed — that is, you. If you use a service for this, the law requires you to choose a processor that provides sufficient guarantees of data protection and to conclude a data processing agreement with it (Art. 28 GDPR). Put simply: you have the right — and the obligation — to know what happens to a document after it is uploaded.
The document's path, step by step
- Upload. The document goes into your personal account and is accessible only to you. It is encrypted immediately — with its own key, separate for each document.
- Translation. The document is processed in the European Union and is not transferred outside it. The translation is done by an AI model on infrastructure that does not store requests and responses and does not pass them to the model developer. Models are not trained on your documents.
- Result. You receive the translation in the layout of the original: tables, blocks and stamps in their places. Passages the model read with low confidence are highlighted — you check these first. Editing, signature and seal remain yours.
- Deletion. The original and the translation are deleted automatically 72 hours after delivery, or manually at any time if you want it sooner. Deletion is cryptographic — more on that below.
How we protect your documents — and what it is based on
- A separate key for each document (Art. 32(1)(a) GDPR — encryption). Every document — both the original and the translation — is encrypted with its own key, not one shared across the account and not one shared by everyone.
- The master key — in the EU and off our servers (Art. 32(1)(b), Art. 44 GDPR). The document keys are protected by a master key held in the AWS KMS key management service in Frankfurt. It never leaves that service and is not stored on our servers: the server can only request decryption. Working with keys outside the EU is blocked in the code.
- Every use of the key is recorded (Art. 5(2), Art. 32(1)(d) GDPR). Every request to the master key is recorded in an AWS log that we cannot alter. Every 10 minutes the system reconciles this log with the application's own activity. If the key was used by a service other than ours, if a request did not come from our servers, or if a decryption does not match an action in the application, we are alerted immediately.
- Incident log and investigation (Art. 33(5) GDPR). Every suspicious event is entered in the incident log. Entries cannot be changed retroactively — only supplemented. For each event the cause is established and recorded.
- 72 hours to notify the supervisory authority (Art. 33(1), Art. 34 GDPR). If an incident affects personal data, the law allows 72 hours to notify the supervisory authority. The deadline is monitored automatically: reminders escalate as it approaches. The decision on notifying the persons affected is taken and documented in the same log.
- Deletion is cryptographic, not mere erasure (Art. 5(1)(e), Art. 17 GDPR). The original and the translation are deleted automatically 72 hours after delivery, or manually at any time. The file is overwritten on disk, but we do not stop there: ordinary erasure does not reach copies — in backups, in the drive's internal cells. That is why the document's key is destroyed together with the document. Without the key, all copies of the encrypted data, wherever they remain, become a set of random bytes that cannot be read.
- No keys in backups (Art. 32(1)(c), Art. 25 GDPR). Document keys are deliberately excluded from database backups. A backup is there to restore the service — but a document cannot be decrypted from it.
- Documents are not used for training (Art. 5(1)(b) GDPR — purpose limitation). Translation takes place in the EU on infrastructure that does not store requests and responses and does not pass them to the model developer.
Who is responsible for data at Lingverra
We are responsible for the processing of personal data at Lingverra. A data processing agreement under Art. 28 GDPR applies automatically to every user — there is no need to request or sign it separately. All companies involved in the processing are listed publicly: what each one does, where it is located and on what basis (Art. 28(2) and (4) GDPR).
One more thing: we do not take orders from your clients and do not compete with you — the client, the signature and the fee stay yours.
Five questions to ask any tool
Whatever you use, these questions help you judge whether a service can be trusted with client documents:
- Is there a data processing agreement under Art. 28 GDPR?
- Where is the data processed — in the EU or outside it?
- Are documents used to train models?
- How long are documents kept, and can you delete them yourself?
- Is the list of sub-processors published?
If the service's documents give no clear answer to one of these questions, that is a reason to be cautious.
What to tell your client
If a client asks what happens to their documents, a short answer is enough: “The document is processed in the EU, encrypted with a separate key, not used to train AI and irreversibly deleted after 72 hours, or manually at any time. I have a GDPR data processing agreement with the service.” For your records, you can attach links to the agreement and to the list of sub-processors.
Frequently asked questions
Do I need to sign anything?
No. The data processing agreement applies automatically to every account.
Can I delete a document right after translation?
Yes, at any time, without waiting for automatic deletion.
Is this suitable for documents with sensitive data?
Documents are processed under the same rules: in the EU, under a separate key, without model training and with cryptographic deletion after 72 hours or manually at any time.
How do I enter the service in my record of processing activities?
In the record under Art. 30 GDPR, the service is entered as a processor. The agreement and the list of sub-processors can be attached directly.
Data processing agreement (Art. 28 GDPR)
Read also: AI translation and GDPR — how to recognise a safe service