Skip to main content
shipi18n logoshipi18n

Nothing to trust us with

Shipi18n is a library, not a service. There is no Shipi18n server in the path, so your source strings and your API key never reach us — there is no "us" to reach.

How the data actually flows

One hop, and you choose the destination.

Your machine or CI runner → the LLM provider you configured → back to your files on disk.

How the data actually flows

One hop, and you choose the destination.

No Shipi18n server

The packages run entirely in your process. There is no API to call, no endpoint to trust, and no infrastructure of ours between you and your model provider.

No account, no database

There is nothing to sign up for, so we hold no email address, no password, no usage record and no copy of your strings. We could not produce your data if we were asked for it.

Files stay on disk

Input and output are files in your repository. Translations are written straight back to the paths you specify, and nothing is uploaded anywhere.

Your API key

It belongs to you and stays with you.

Read from the environment

The key is read from ANTHROPIC_API_KEY or OPENAI_API_KEY (or passed explicitly in code) and used to authenticate directly with that provider. It is never written to disk, logged, or transmitted anywhere else.

Never shipped to a browser

Every integration runs at build time or in CI, never in a page. No configuration we document puts an LLM key into client-side JavaScript, because a key in a browser is a key that has been leaked.

CI secrets

In GitHub Actions the key comes from repository secrets and is masked in logs. Rotate it like any other credential; nothing in Shipi18n caches or remembers it between runs.

Checking needs no key at all

The MCP server’s validation tools are deterministic: they compare your files and call no model, so they run with no API key anywhere in the setup. For meaning-level review, your own agent does the reasoning with the model it already has.

Supply chain

You can read everything that runs.

Fully open source

Every package is Apache-2.0 and developed in the open. The prompts, the placeholder validation and the batching logic are all readable in the repository — there is no closed component.

Small dependency surface

The engine has no runtime dependencies of its own. The provider SDKs are optional peer dependencies, so you install only the one you actually use.

Pin what you ship

Packages are published from a public monorepo with tagged releases. Pin exact versions and audit the diff before upgrading, exactly as you would with any other dependency.

What your provider sees

The one place your strings do travel — under your own account and your own agreement.

Shipi18n sends the strings being translated, plus surrounding keys for context, to the provider you selected. That request is governed by your contract with that provider, not by us. Both major providers state that API traffic is not used to train their models by default — check their current terms yourself rather than taking our word for it.

If a string must never leave your network at all, point the adapter at a self-hosted model: any object with a complete(prompt) method is a valid provider.

Recommended practice

  • Keep keys in a secret store or your shell environment — never in the repository, and never in a committed .env file.
  • Commit generated locale files and review the diff. Generated copy deserves the same review as generated code.
  • Use skip-keys to keep legal text, brand names and anything regulated in the source language.
  • Issue a provider key scoped to this use where your provider supports it, so it can be rotated without touching anything else.

Reporting a vulnerability

If you find a security problem in any Shipi18n package, email us and we will respond. Please do not open a public issue for anything exploitable until it is fixed.

team@shipi18n.com