Security and data protection

Where your data lives

Your database and uploaded files are stored in the EU (Frankfurt). The application itself is delivered through a global edge network, so the pages and API responses you request are served from wherever you are — the stored data does not move with them.

Some supporting services operate outside the EU. We publish them as categories, with their regions, in our Data Processing Agreement and our Privacy Policy, and the full list with names is available on request. Where data goes outside the UK we rely on the transfer safeguards set out in the DPA.

Encryption, isolation and backups

• Encryption— data is encrypted in transit and at rest, using TLS 1.2 or later for transit and AES-256 for storage.
• Tenant isolation— separation between customers is enforced in the database itself with Row Level Security policies, not only in application code, so one customer cannot read another customer's data.
• Backups— automated daily backups with point-in-time recovery. Backups are encrypted and held in a geographically separate location.
• Access control— role-based access on the principle of least privilege, enforced by row-level security in the database rather than by application code alone.
• Monitoring and incident response — real-time error monitoring and alerting, automated rate limiting, and documented incident response procedures with defined escalation paths.

These are the measures written into section 6 of the Data Processing Agreement.

Who at VectorLingo can see your data

Access to production systems is restricted to authorised personnel on a need-to-know basis. That is the commitment in the DPA, and it is the whole of what we are prepared to promise today. We are not publishing a formal access-approval workflow or customer-data access logging, because neither exists yet.

If something goes wrong

If a personal data breach affects your data, we will notify you without undue delay and in any event within 24 hours of becoming aware of it, with what we know about the nature of the breach, the categories of data affected, the estimated number of data subjects affected, the likely consequences, and the measures we are taking. That is a contractual obligation, set out in section 3 of the DPA.

Getting your data out, and getting it deleted

You can export your content after your subscription ends, and we delete it on a published timetable after that window closes — from active systems first, then from backups. We have deliberately not repeated the periods here, so there is only one place to keep them accurate: the export window is in the Terms of Service and the deletion timetable is in section 3 of the DPA.

What we are not

VectorLingo is not SOC 2 certified and not ISO 27001 certified. We hold no third-party security certification. If your procurement process requires one, we are not a fit for you today, and we would rather you knew that on this page than three calls in.

What we do have is a signed Data Processing Agreement covering UK GDPR processor obligations, including the audit rights in section 7, and the measures above.

If you are a freelancer working for an agency that uses VectorLingo

Agencies use VectorLingo to keep their own record of the people they work with. That record can include star ratings, an internal flag, private notes and a count of completed jobs. Two things about how the product handles it:

• The vendor portal displays none of it. VectorLingo does not show ratings, flags, notes or job counts to vendor-portal users, in the emails it sends them, or on the documents it produces for them.
• Ratings are scoped to one agency. They belong to the tenant that recorded them. There is no cross-agency reputation score, no league table and no ranking that follows you from one customer to another.

What that is not: a promise that you can never find out what an agency has written about you. The agency is the data controller for its own records, you keep your rights over your personal data under UK GDPR, and a subject access request goes to the agency, not to us. We would act on their instructions in handling it — see the DPA.

Questions

Security and data protection questions go to privacy@vectorlingo.com. Everything else is on our contact page.