Security overview

Scope

This overview concerns the TilBridge translation-management application, not just this marketing website. It describes the application’s implemented controls and declared production architecture. The services enabled for your organization, processing locations, and contractual terms should be confirmed with us before you upload confidential or personal project data.

TilBridge is operated by Tilbridge Tech LLP, BIN 260440008140, Almaty, 69A Satpayev St., Office 401, Kazakhstan. We serve international customers; the operator’s location, hosting locations, and external processing locations are distinct facts.

Access and isolation

• Application access is authenticated. Organization membership and role-based authorization govern access to projects and operations.
• Organization-scoped database transactions and row-level security policies provide layers of logical tenant separation. This is not a dedicated database or server for each customer.
• File access uses tenant-scoped object keys and signed access URLs. Treat a signed download link as a temporary access credential and share it only with authorized recipients.
• Stored AI-provider credentials are sealed using AES-256-GCM encryption. Authorized application processes still need to use those credentials and process project content; this is not end-to-end encryption.

Data protection

The declared production architecture uses AWS application hosting, private encrypted RDS PostgreSQL, and private encrypted S3 object storage, with primary-region configuration in Frankfurt (eu-central-1). Public application delivery uses CloudFront. These configuration facts do not imply that every external provider, network edge, or support-access location is in the EU.

The application includes controls for minimizing sensitive content in operational diagnostics. Optional event emission to your organization’s own self-hosted or cloud-hosted Langfuse instance and masked session replay are separate capabilities with their own activation and data-handling considerations. TilBridge does not provide a hosted Langfuse trace store. See Project-data handling.

Database backups and object versioning support recovery. They are not the same as a customer-data retention policy or a guarantee of immediate deletion from every copy. We confirm the applicable return and deletion arrangements as part of the evaluation discussion.

Before your demo and evaluation

A demo needs no project data from you. Before you evaluate TilBridge with your own material, tell us about your data sensitivity, permitted processing locations, required AI providers, and any restrictions imposed by your own customers. We can then review the proposed configuration and contractual requirements with you.

This overview is not an independent security assessment, certification, or service-level agreement. Specific security questionnaires, supporting evidence, and contractual commitments should be addressed directly with us. We do not present this page as a blanket claim of compliance with every jurisdiction.

For processing-agreement discussions, see DPA enquiries.

Contact

For privacy or a suspected project-data security issue, contact privacy@tilbridge.kz. For agreements, contact legal@tilbridge.kz.

In an initial report, provide a brief description and a way to contact you. Do not email passwords, API keys, signed download URLs, or confidential project files. We can agree an appropriate way to exchange any necessary evidence.