LILT pairs context-aware AI with expert human verification to deliver high-consequence multilingual content at enterprise scale. This Trust Center provides transparent access to our security program, including policies, controls, certifications, subprocessors, and live status, with deeper due-diligence materials available under NDA. We offer end-to-end control over data and models across 100+ connectors and flexible deployments (cloud, on-prem, and fully air-gapped). LILT is committed to protecting customer data through layered security controls, strong privacy practices, and continuous risk management, and we regularly enhance our program via employee training, risk assessments, and third-party evaluations to meet or exceed industry standards
Controls
Access control
Strong identity verification and least-privilege practices restrict system access to authorised users only
All administrative and cloud console accounts require MFA, adding a second verification step that blocks credential-only attacks.
Customers may enforce SSO for their users, simplifying onboarding while keeping credentials under their own identity provider’s governance.
Permissions are assigned to roles aligned with job duties so users receive only the minimum rights needed to perform their work.
Access to production and sensitive data is reviewed at least annually (quarterly for PHI/PII) and revoked immediately when no longer required.
Data security
Encryption, classification and lifecycle controls safeguard customer information from creation to secure deletion
All customer data stored in databases, file systems and backups is protected with AES-256 encryption managed by Lilt-controlled keys.
TLS 1.2+ with HSTS secures every connection to the platform, preventing eavesdropping and downgrade attacks.
A published policy defines restricted, confidential, internal and public data tiers so appropriate security controls are consistently applied.
Customer data is deleted 90 days after account closure and corporate records follow a documented retention table, ensuring information is not stored longer than necessary.
Application security
Secure development lifecycle, continuous testing and independent assessments keep the code base resilient to attack
Developers follow an Agile SDLC with peer code review, branch protection and ticket-based change tracking to prevent defects from reaching production.
Tools such as Trivy and Wiz scan every build for known CVEs so vulnerable components are remediated before release.
External security specialists perform comprehensive penetration tests each year and engineering promptly fixes any findings.
All changes pass unit, integration and regression tests in staging and require managerial approval before they can be deployed to production.
Infrastructure security
Hardened cloud infrastructure, continuous monitoring and robust key management protect the underlying platform
Workloads run in ISO 27001 and SOC 2 compliant regions with multi-zone redundancy to ensure high availability and physical security.
Processing, storage and content delivery are separated so an issue in one layer cannot compromise the others.
Datadog, Stackdriver and Prometheus collect logs and metrics, raising real-time alerts to engineers for abnormal activity.
Encryption keys are stored in hardware-backed modules, access-controlled per user and rotated at least annually.
Compliance and auditing
Documented controls and third-party assessments demonstrate alignment with leading security and privacy standards
Independent auditors test the security, availability, confidentiality, integrity and privacy controls each year and issue an attestation report.
Data processing agreements, DPIAs and data subject rights procedures ensure personal data handling meets EU requirements.
All administrative actions, access events and system changes are recorded in immutable storage for forensic and compliance purposes.
Penetration tests, vulnerability scans and policy audits by external firms validate that controls remain effective and mature.
Business continuity
Resilient architecture, regular testing and comprehensive backups keep services available during disruptive events
Production workloads run across multiple regions so a data-centre outage does not interrupt customer operations.
Leadership reviews preparation measures every quarter to confirm they remain current and effective.
The team executes tabletop and live recovery drills each year, measuring RTO/RPO and refining procedures.
System and customer data is snapshot-backed up each day to a separate region, encrypted and monitored for success.
Incident response
A trained security incident response team and documented plan enable rapid detection, containment and communication
Clear procedures define roles, escalation paths and communication protocols for handling security events.
Named personnel, including an incident response lead, are on-call to investigate and remediate 24 × 7.
Processes meet GDPR 72-hour and HIPAA 60-day requirements, ensuring customers and regulators are informed promptly.
Every incident triggers a lessons-learned session to address root causes and strengthen defences.
Employee security
Screening, training and clear policies create a security-minded workforce
Final candidates undergo background screening proportional to their role before they are hired.
All staff complete onboarding and annual refresher training covering phishing, data handling and policy requirements.
Company laptops and mobile devices must use full-disk encryption, auto-lock and approved antivirus software.
Physical documents and unattended screens are protected and technology resources may only be used for authorised business purposes.
Third-party management
Structured onboarding and oversight processes reduce risk from vendors and suppliers
Security questionnaires and InfoSec checklists evaluate vendors before they gain access to data or systems.
Legal templates ensure suppliers commit to confidentiality and privacy obligations aligned with Lilt and customer requirements.
Only suppliers that pass security, legal and procurement reviews are authorised for production use.
A public list of subprocessors and contractual flow-downs give customers visibility and assurance over downstream providers.
AI governance
Policies and controls manage responsible AI use and protect customer data in machine-learning workflows
Highly restricted data categories may not be entered into standalone AI tools unless explicitly approved by Legal.
All AI-generated content is reviewed and fact-checked by employees before it is shared externally, preventing hallucinations or bias.
The policy mandates opt-in only training and requires model-training features to remain disabled by default.
Staff may only use company-provided accounts for vetted AI solutions, ensuring usage is auditable and compliant.
Vulnerability management
Continuous scanning, defined SLAs and a public disclosure channel keep the platform free of known weaknesses
Critical and high findings are fixed within 30 business days, medium within 90 and low within 180, providing predictable risk reduction.
Trivy, Wiz and AWS scanners run against code, containers and cloud resources to surface newly published CVEs.
SonarQube enforces coding standards and flags security smells before code can merge to the main branch.
Researchers can report vulnerabilities via a dedicated email and are guaranteed safe harbour, expanding defensive coverage.
Key management
Centralised control over cryptographic keys maintains confidentiality and simplifies auditing
Keys are held in tamper-resistant modules, preventing extraction even by privileged insiders.
The key management service rotates encryption keys at least annually or sooner when required.
Distinct user roles separate key administration from key usage, limiting potential misuse.
Secure escrow ensures encryption keys can be recovered during disaster recovery without exposing them during daily operations.
