Built to touch your production files, and your bill.
Echo Lingua reads your locale catalogs and runs inside your release pipeline, so it is designed to be careful with both. Here is how access, delivery and spend are controlled.
Authentication
There is one boundary with two ways in: the web app authenticates with your account, and the HTTP API authenticates with scoped API keys. API keys are elk_-prefixed, shown once at creation, carry an expiry, and can be revoked at any time. Every request is attributed to the key that made it.
Scoped access
A key grants only what you allow. translate:write can create, retry and cancel jobs; jobs:read can read job status and download output. Nothing a scope doesn’t cover is reachable with that key.
Signed webhooks
Every webhook delivery is signed with HMAC-SHA256 over the raw request body and sent as X-EchoLingua-Signature, alongside X-EchoLingua-Timestamp and X-EchoLingua-Delivery. Verify the signature against your endpoint secret before you act on a payload. Failed deliveries retry with bounded exponential backoff.
You review before anything ships
Every translated entry is checked for placeholder and markup integrity. Anything that fails is flagged in the catalog as #, el-review and never merged silently. Output is standard gettext you can diff and review before it lands in your repository.
Organisation boundaries
Your organisation is the data and billing boundary — jobs belong to it, not to individuals. You decide whether members see only their own department’s jobs or the whole team’s, and which managers may view usage, manage billing, or edit the shared glossary.
Spend safety
Nothing runs before you approve a cost estimate. Balances are prepaid, per-department caps are hard limits, and jobs pause rather than overspend. Spend is attributed per member and per key, with billing history to back it up.
Your content and AI providers
To translate, your source strings are sent to the AI provider you select (Anthropic, OpenAI or Gemini) to produce the translation. For each provider’s data-handling terms, a data-processing agreement, or specifics on retention and data residency, contact us.
Reporting a vulnerability
Found something? Please report it responsibly to security@echo-lingua.com and give us a reasonable window to respond before any public disclosure.
This page describes the product’s security model. For a formal security review or a DPA, talk to us.