Security Policy

Last updated: October 2, 2026

Overview

We understand how important it is to protect your personal information, files, and payment data. Whether you are placing an order, submitting sensitive materials, or managing your account, you can trust that we take every measure to keep your data secure.

This Security Policy outlines the technical, organizational, and procedural safeguards we use to protect your information. While no system can be completely immune to risk, we continuously monitor, maintain, and improve our infrastructure and practices.

1. Data Encryption

All data transmitted through this website is encrypted using HTTPS and TLS protocols. This ensures that every page load, form submission, file upload, and account action is protected in transit.

Stored data is likewise protected with industry-standard AES-256 encryption. Whether you are placing an order, checking status, or downloading a translated file, your connection and data are protected.

2. Secure Hosting Environment

Our services are deployed on reliable cloud infrastructure, using firewalls, active threat monitoring, regular patching, and data center security controls to protect hosted applications. All servers are security-hardened and regularly updated. We isolate customer data and follow the principle of least privilege.

3. Secure File Storage

Uploaded and translated files are stored in an object storage system with the following security features:

  • Encryption at rest (AES-256)
  • Access control lists (ACLs) ensuring only authorized services can access files
  • Automatic expiration and deletion — identity documents are deleted immediately upon order completion; other original files are automatically deleted after 90 days; translated files are retained permanently

4. Access Control

Access to sensitive customer data is strictly limited to authorized personnel with a legitimate need. Our translators and internal staff are only granted access to the specific files or information required to complete their assigned work.

All team members are required to sign confidentiality agreements and undergo training in secure data handling. Administrative access to infrastructure is restricted, logged, and continuously monitored.

5. Payment Security

We process all payments through WeChat Pay and Alipay, in compliance with the People's Bank of China and other relevant financial regulatory requirements. The exchange of sensitive data during payment is handled entirely on the payment institution's side — our systems only receive non-sensitive information such as order number, amount, and payment result.

We never store your payment card number, bank account password, or other payment credentials on our own servers. Payment information is transmitted and processed directly and securely by WeChat Pay / Alipay, protecting your financial data from unauthorized access.

6. System Monitoring and Updates

We proactively monitor our systems to detect unauthorized access, suspicious activity, or performance issues. Automated alerts and manual review help us maintain high availability and security standards.

Security patches are applied regularly, and we follow best practices for software development and deployment. Our team continuously tracks the latest security vulnerabilities and threat intelligence to minimize risk and respond quickly when needed.

7. Confidentiality

We understand the sensitivity of the documents entrusted to us — whether personal, legal, medical, or financial. We handle your information with the utmost care and confidentiality.

All translators and staff are contractually bound to strict confidentiality. Your files will not be shared or used for any purpose other than completing your order, and we will not disclose customer data to third parties without your explicit consent.

8. Third-Party Services

We work only with carefully vetted third-party service providers, including hosting, file storage, payment processing, and data analytics services. Before integrating any service, we review its security practices and data handling policies.

9. Account Security

We use passwordless login (email one-time verification codes), eliminating the risk of password leaks. Every login is verified with a one-time code that expires after 5 minutes and becomes invalid once used.

Other account security measures include:

  • A security notification email is sent when you log in from a new device or IP address
  • Automatic 15-minute lockout after 5 consecutive incorrect verification code attempts
  • Access tokens are valid for 2 hours, refresh tokens for 7 days; tokens are invalidated immediately upon logout
  • Sensitive actions (such as account deletion) require additional verification and a 7-day cooling-off period

10. Contact Us

If you have any questions about this Security Policy, or wish to report a security concern, please contact us: