Lokalise security and compliance for enterprise teams

Lokalise has an internal Security team that covers all aspects related to IT Security. The Security team works closely together with the Legal department on compliance and data protection matters.

Our security operations are aligned with ISO27001 principles and recommended processes. We have several processes in place and an extensive set of cybersecurity-related policies which help monitor security risks. Technical ones like log management, access management, and vulnerability scans, as well as continuous user education and assessment. All procedures are documented and in good standing as certified by SOC2 Type 2 certification.

We use CIS guidelines for server/device and service hardening.

Employee equipment is protected by an enterprise-grade antivirus solution.

We have several internal solutions in place that are used for monitoring our systems, application availability, and other critical parameters. We also have in place a solution that allows us to manage and monitor the performance of our application.

In addition to the above, we have implemented a log management tool and we are currently increasing our visibility by making sure that all critical logs are forwarded to the central tool.

There is an ongoing vulnerability and patch management process in place. Server operating systems are regularly patched and updated and we have multiple internal processes in place that help identify any potential vulnerabilities.

Lokalise has implemented risk management as an ongoing process in its key business processes so it organically aligns with day-to-day operations. This approach is intended to align the entity’s strategy more closely with its key stakeholders, assist the organizational units with managing uncertainty more effectively, minimize threats to the business, and maximize its opportunities in the rapidly changing market environment.

Lokalise identifies the underlying sources of risk, measures the impact on organizations, establishes acceptable risk tolerance levels, and implements appropriate measures to monitor and manage the risks.

To support the delivery of our services, Lokalise, Inc. may engage and use data processors with access to certain Customer Data. This sub-processors page provides important information about the identity, location, and role of each Sub-processor.

We evaluate every third party with which we are going into a business relationship. Evaluation includes - such points as Ownership, country of residence, security attestations, data protection measures, previous incidents, etc.

Lokalise has an established Incident Response policy.

If we identify that customer data was affected as the result of an incident we will inform the affected customers within 48 hours. The provided information will depend on a case-by-case basis.

All incidents can be reported to support at hello@lokalise.com or using the in-application chat functionality.

Lokalise has sound business ethics, which we maintain by hiring and retaining high-quality personnel. All employees know their responsibilities and roles in connection with information security and undergo regular security awareness training. That way, we minimize the risk of human error such as theft, fraud, and misuse of information assets.