[Security]

Repository access should be specific, visible, and revocable.

Polyglot separates read-oriented Checks from catalog publication, authenticates managed workflows with short-lived credentials, and verifies the exact candidate before a write-capable App can open a pull request.

Read technical security docsService status ↗
[01]Separate identities

GitHub App

Polyglot Checks

Analyze revisions, write the native Check, and dispatch the repository's configured workflow.

  • ✓ Metadata: read
  • ✓ Contents: read
  • ✓ Pull requests: read
  • ✓ Checks: read/write
  • ✓ Actions: read/write for configured dispatch; Administration: read/write for verified merge protection

No contents-write permission. Administration access is limited to inspecting merge rules and, only after an admin confirms, managing Polyglot's dedicated ruleset. The service does not alter unrelated workflows or rules.

GitHub App

Polyglot Publisher

Create or update a verified catalog branch, commit, and pull request after review.

  • ✓ Metadata: read
  • ✓ Contents: read/write
  • ✓ Pull requests: read/write

Installed separately on selected repositories. It cannot publish until the customer-run workflow returns a verified catalog-only result.

[02]Managed credentials

No long-lived Polyglot project secret in the caller.

The caller requests a GitHub OIDC token. Polyglot validates the issuer, audience, repository, workflow, event, revisions, run, and immutable workflow pin before issuing a short-lived, run-bound credential. Missing or inconsistent claims fail closed.

Immutable caller

The reusable managed workflow is pinned to a complete commit SHA.

Bound run

Credentials are scoped to one repository, operation, run, and revision set.

No false green

Incomplete analysis, unavailable history, and policy drift never conclude success.

Kill switches

Checks, dispatch, catalog sync, generation, verification, and Publisher writes can be disabled independently.

[03]Public processing summary

Where your strings go

What stays in your repository, what reaches Polyglot, and which providers help us run the service.

Local scanning and plans
Scanning and plan previews run in your repository, and applying a plan only changes local files. Translation is the exception: requesting it sends the selected source strings and their context to Polyglot.
Polyglot hosting · Render
The API and dashboard run on Render. When you turn on catalog sync, Polyglot receives keys, values, existing translations, paths, and metadata. Translation memory and review and publication records are stored in our database.
Translation inference
Translation requests go to a third-party inference provider's API. Each request contains the selected strings, their context, and translation instructions. The provider processes requests transiently and doesn't train on them; it may keep limited logs for debugging and security.
Repository workflow · GitHub
Managed checks send findings and run metadata to Polyglot — never raw source excerpts. GitHub hosts your repository, workflow runs, check results, and catalog PRs under your GitHub account's terms.
Supporting services
Cloudflare handles edge delivery and security, PostHog product analytics, Sentry error reporting, Resend account and contact email, and Stripe payments. Each receives the data relevant to that job.

Translation memory and audit records follow the retention schedule in our privacy policy. Our full subprocessor list is available on request.

Polyglot privacy and retention Discuss processing requirements

Last updated September 22, 2026.

[04]Data boundaries

Managed checks

Bounded metadata, not raw excerpts

Check reports include immutable revisions, hashes, policy and configuration identity, CLI version, counts, conclusion, paths and locations, categories, remediation, and keyed fingerprints. Raw finding values and source excerpts are not uploaded.

Catalog synchronization

Content only after explicit consent

After an owner accepts the disclosure, the trusted repository workflow may upload catalog keys, source strings, existing translations, paths, formats, languages, hashes, and related metadata needed for review and publication. Revoking consent blocks future uploads.

Publication

Allowed paths and exact verification

The candidate may change only configured catalog paths. Polyglot records the manifest and who approved what, verifies the configured command on the pristine base and exact candidate, and then opens a pull request. It never writes directly to the default branch.

Revocation

Disconnect one capability without surrendering the rest

Uninstall the Publisher App to stop repository writes while retaining Checks. Uninstall the Checks App to stop managed analysis and dispatch. The local CLI and open Action remain available, and organization deletion removes tenant-linked data.

[05]Retention + deletion

Content expires before long-lived audit.

Defaults are enforced by scheduled retention and redaction jobs. Disconnecting revokes future access; organization deletion is the tenant data-deletion boundary.

30 daysWebhook metadata, OIDC exchanges, and run-credential digests
90 daysFinding details and superseded unreferenced catalog or publication content
400 daysBounded run, audit, funnel, and service-level history

This page is a product security summary, not a certification or compliance trust center. See the Privacy Policy for legal terms and the technical documentation for operational detail.

Start in your terminal

Stop hunting for untranslated strings.

Install the CLI, run a scan, and see exactly what you're missing. Free, no account required.

$curl -fsSL https://getpolyglot.ai/install.sh | bash
Security — GitHub permissions and Automation data boundaries | Polyglot