A thin slice. Never your whole codebase.
The scan runs in your repo, on your side. It sends Dialecto your translation files and the small usage snippets we need to be precise — and nothing else. We never clone, read, or store your repository. We take exactly what we need and not a stroke more. You keep the rest.
This is architectural, not a policy promise. There is no setting to get wrong, because there is no pipe that could carry your codebase in the first place.
The posture, point by point
Data minimization
We hold your translation files and the usage snippets we need. Never your whole codebase. Your repository is never cloned, never vendored, never stored.
Authentication
Self-hosted auth — magic link and password, scope-based sessions, hashed and expiring tokens, sudo mode for sensitive actions. No third-party identity SaaS in the path.
Authorization
A role-based access matrix, re-checked server-side on every mutation — in the context layer, not just the UI. Guessing another object's ID gets you nothing.
Secrets
Database and access-token credentials are encrypted at rest with a key kept separate from the application secret. The GitHub App key lives in the environment, nowhere else.
API hardening
Scan tokens compare in constant time. Repositories are isolated from each other. Request bodies are capped. Rate limiting is on.
Engineering gate
Every change passes strict static analysis, security scanning, and type checking before it lands. The gate we sell you is the gate we live behind.
Auditability
A full, attributed activity trail. Revision history on every entry with one-click revert. You can always answer who changed what, and when.
Machine-translation guardrails
Human-in-the-loop by design. Suggestions default to review. Autofill is a per-repo choice you make. Everything ships through the pull-request flow — nothing an aid produces merges on its own.
Responsible disclosure
Found something? We want to hear it, fast and directly. Write to security@dialecto.eu and you'll get a human, not a form.
Sovereignty is its own story — EU jurisdiction, local machine translation, self-hosting.