Lokalise’s industry-leading security

Lokalise has sound business ethics, which we maintain by hiring and retaining high-quality personnel. All employees know their responsibilities and roles in connection with information security and undergo regular security awareness training. That way, we minimize the risk of human error such as theft, fraud, and misuse of information assets.

Lokalise uses a role-based security architecture and requires users of the system to be identified and authenticated prior to the use of any system resources. For enhanced security, we support enabling 2-factor authentication for every user and also support login with social accounts like Google, GitHub, and Microsoft. Customers also can use SAML to authenticate users from their enterprise directory. Your employees can access the company services through the Internet using the SSL functionality of their web-browser. The employees must supply a valid Google account to gain access to customer cloud resources.

We use encryption technologies to protect customer data both at rest and in transit.

Our Information Security Policy is based on the guidelines of ISO/IEC 27001. It outlines Lokalise's approach to the protection of our systems and data. Each policy, standard, and guideline has an Owner to ensure information security at Lokalise. Owners are responsible for managing the risks outlined in the Policy Objective. We carry out regular internal and external audits to examine our compliance with general requirements of ISO 27001, SOC2, HIPAA, and PCI DSS.

Access to our offices is restricted and enforced by security personnel services. When confidential information is physically stored on our premises, access is only available to authorized personnel.

We design our processes and procedures to meet the business objectives of our services. Those objectives are based on the service commitments that we make to user entities, the laws and regulations that govern the provision of the services, and the financial, operational, and compliance requirements that we have established. Security commitments to user entities are documented and communicated in service-level agreements (SLAs) and the general Terms of Service available at https://lokalise.com/terms, as well as in the description of the service offering provided online. Security principles within the fundamental designs under GDPR are designed to permit system users to access the information they need based on their role in the system while restricting them from accessing information not needed for their role. Security commitments to user entities are documented and communicated in Service Level Agreements (SLAs) and the general Terms of Service available at https://lokalise.com /terms, as well as in the description of the service offering provided online. Security principles within the fundamental designs under GDPR that are designed to permit system users to access the information they need based on their role in the system while restricting them from accessing information not needed for their role.

We continuously monitor our system and infrastructure for security incidents. Incident response policies and procedures are in place and regularly reviewed to guide our team in reporting and responding properly to information system incidents.

Redundancy is built into the Lokalise application in multiple layers of the system to help ensure that there is no single point of failure. In the event of a component failure, it will recover automatically without, or with very minimal, interruption. Penetration testing is conducted to measure the security posture of our system at least annually. Penetration testing is conducted to measure the security posture of a target system or environment. Every nine months, we perform a simulation to test the Lokalise disaster recovery plan.

Our software development process includes extensive code reviews during the code development phase and before code is pushed to production. We also perform regular audits and checks against known security flaws, including the OWASP Top Ten.

We have designed and implemented controls to monitor our vendors. In addition, we perform due diligence on any vendor before signing the agreement. We review and make sure that our vendors meet the same or higher standards regarding security, availability, and confidentiality as we do for our customers.