The Data Location Problem in Cloud Translation Platforms

Over the past fifteen years translation tools have moved from the desktop to the cloud. A team can work on the same project at the same time, version confusion disappears and the bother of installation is gone. The operational gain is beyond dispute.

Contents

In return, cloud translation tools raise a new question: data location. In which country and on which server does your document sit, who can reach it there, and which law governs that access?

This article takes the question out of the realm of technical curiosity and ties it to the purchasing decision: why is location a legal threshold, is choosing a region enough, and which questions should be put to the provider?

Where is the “cloud” really?

The cloud does not mean that the data is nowhere. It means that the data is somewhere you do not know. Every cloud service runs on disks sitting in a physical data centre, and those disks are inside the borders of a country.

Translation platforms mostly do not run their own data centres; they rent capacity from large infrastructure providers. This adds an invisible link to the chain: the platform’s own supplier. The firm you sign a contract with and the owner of the machine your data sits on may not be the same party.

The interface being in Turkish, the support team being based in Türkiye or the invoice being issued in Turkish lira tell you nothing about where the data is. These are commercial arrangements; the hosting decision is a separate layer.

Location information is usually not kept secret; it is simply never asked for. Many platforms state their data centre regions openly in their documentation. The problem is that this information is not requested during the purchasing process and is not carried into the contract. Reading the documentation produces an answer faster, in most cases, than a lengthy compliance review.

Why is data location a legal threshold?

Uploading a document containing personal data to a server abroad counts, in legislative terms, as a transfer abroad. The moment the transfer takes place, additional obligations arise, and those obligations rest with the party sending the document.

Article 9 of Law no. 6698 was amended by Law no. 7499 and the new version came into force on 1 June 2024. The new structure is tiered: first an adequacy decision; failing that, appropriate safeguards – a standard contract announced by the Board, binding corporate rules or an undertaking – and exceptions only in incidental cases.

A process that regularly uploads documents to a cloud platform is, by definition, a systematic transfer. In a flow of this kind, relying on explicit consent is not considered sufficient; an appropriate safeguard is required. If a standard contract is used, it must be notified to the Board within five business days of signature.

Not knowing the location does not remove the obligation. On the contrary, it means you cannot show which tier you are relying on.

Is choosing a region enough?

Many platforms offer the option of choosing a data region during set-up. This is a good start, but it determines where the main data sits; it may not cover the whole system.

In practice four separate flows can leave the region. Backups may be held in a different region. System logs may flow into a central logging system, and logs often contain file names. The support team may open access from another country while troubleshooting. Add-on services such as machine translation or spell checking may connect to separate providers.

The right question is therefore not “can I choose a region” but “does the choice of region also cover backups, logs, support access and add-on services”. The answer is usually hidden in the sub-processor list in the contract annexes.

The sub-processor list is the most informative document a platform has. It shows who is involved, for which service and in which country they work. Publishing the list and giving advance notice of changes is a distinguishing mark of a mature provider. If the list is not shared, the choice of region should not be treated as a guarantee on its own.

Hosting models: a comparison

There is no single correct model; the choice follows the sensitivity of the document. The table below compares four common set-ups.

Model	Where is the data?	Strength	Weakness
Desktop tool	On the translator’s device	Never leaves the device	Backup and access control are left to the individual
Domestic hosting	In a data centre in Türkiye	No transfer issue arises	The choice of tools may be narrower
Cloud abroad with a choice of region	In the chosen region, backups may vary	Mature tools, strong workflow	Transfer regime and sub-processors
Dedicated corporate server	On the organisation’s own infrastructure	Full control	Set-up and maintenance cost

For most organisations the practical solution is a mixed one: sensitive documents are handled on domestic or dedicated infrastructure, while general content is processed in mature cloud tools. The distinction has to rest on document classification, otherwise the exception turns into the rule over time.

The cost of a mixed set-up is usually lower than assumed, because sensitive documents make up a small share of total volume. Most of an organisation’s translation budget goes on product content, marketing copy and technical documentation; seeking additional conditions for these creates needless cost. Failing to draw the distinction, on the other hand, does harm in both directions: either everything becomes more expensive, or sensitive documents are left unprotected.

What do certificates say, and what do they not?

Information security certificate logos are a common sight on provider websites. These documents are valuable because they show that a management system has been independently audited. A certificate does not, however, tell you which country the data sits in.

Every certificate has a scope document: which processes, which locations and which services were audited? The scope is often narrower than assumed. The head office having been audited does not mean that the subsidiary or the subcontractor actually doing the work has been audited as well.

Use the certificate not as a criterion for rejection but as the start of a conversation: ask for the scope document, look at the validity date and ask whether the scope covers your project. These three steps are more informative than counting logos.

Exit plan: what happens when you leave a platform?

Discussion of data location usually focuses on the start of the service. The real test, though, comes when the contract ends. A significant proportion of organisations leaving a platform never even notice that their data has stayed behind.

Three things need to be recovered: the source and target documents, the translation memory and the termbase. The first is usually returned without difficulty. The second and third often become a matter of dispute; some providers treat them as their own asset. For that reason the right to export, and the format – TMX, for instance – have to be written into the contract.

Destruction is a separate step after return. Your data being handed over to you does not mean that the copies on the platform have been deleted. Set a reasonable period for destruction, have it written down that backups are covered as well, and ask for written confirmation that it has been carried out. That confirmation is a ready answer to an audit question you may face later.

Questions to ask the provider

The seven questions below reveal a platform’s stance on data location without calling for any technical knowledge. It matters that the answers are requested in writing:

1. In which country’s data centre is the main data held?
2. Are backups stored in the same country, and for how long are they kept?
3. Where do system logs flow, and do they contain file names?
4. From which countries can the support team reach the data, and is that access logged?
5. Is the sub-processor list shared, and are changes notified in advance?
6. Is the machine translation engine on by default, and can it be switched off project by project?
7. When the contract ends, within what period are the data and the translation memory returned or destroyed?

Not every answer has to be positive. What matters is that the provider can answer these questions without leaving them vague. A vague answer is often worse than a negative one.

Asking the questions at the quotation stage is more effective than asking at the contract stage. While submitting a quotation the provider is willing to explain; once the contract is signed the same questions are received as an additional demand. Adding the answers to the quotation file closes off most of the arguments that would otherwise arise later.

The Türkiye context

In Türkiye some corporate buyers, particularly companies working with the public sector and financial institutions, write into their contracts that the data must stay within the country, because of sector-specific regulation. This requirement is reflected in translation procurement as well, turning domestic hosting from a preference into a condition.

On the market side, small and medium-sized agencies mostly use cloud platforms based abroad; these tools are mature, cheap and widespread. The result is a mismatch in which the buyer sets a domestic condition while the supply chain in fact extends abroad. The mismatch is usually noticed not at the tender stage but during an audit.

Another local factor is language data. Turkish is relatively under-represented in large language resources; Turkish texts are therefore valuable to those developing models. Asking whether the text you upload will be used for service development purposes is especially meaningful for Turkish content.

What does this mean for you?

Data location is a commercial rather than a technical part of the purchasing decision. The following three moves produce results quickly in most organisations.

First, divide your documents in two: those containing personal data or trade secrets and those that do not. Second, write the hosting condition for the first group into the tender and contract text; do not settle for verbal assurances. Third, add the seven questions above to your supplier assessment form and file the answers.

These three steps will not prevent a leak on their own, but they make clear where responsibility sits and turn supplier selection into something measurable. On sensitive projects we run the process domestically from end to end and keep machine translation engines switched off by default. For the details of the arrangement you can look at our services page, or request a quotation for a workflow tailored to your project.

This article is for general information and is not legal advice. Consult your legal adviser about your particular situation.

Frequently asked questions

If the provider is a company in Türkiye, does the data sit in Türkiye too?

Not necessarily. The invoice may be issued by a company in Türkiye while a platform hosted abroad runs underneath. What is decisive is not the company’s address but where the data actually sits and can be accessed.

Is it enough to choose Türkiye or Europe as the region?

Not on its own. Even if the main data sits in the chosen region, backups, log records and support team access may come from other countries. You should ask whether the choice of region also covers backups and support access.

Is using a desktop tool safer than the cloud?

Not automatically. With desktop use the data stays local, but encryption, backup and access control are left entirely to the user. The risk of loss and theft rises. Security depends less on the model itself than on the quality of the arrangement.

Do certificates guarantee data location?

They do not. Information security certificates show that a management system has been audited within a defined scope; they do not show which country the data sits in. Reading the certificate’s scope document is more informative than seeing the logo.

Sources

• Pietrzak, P. & Kornacki, M. (2021). Using CAT Tools in Freelance Translation. Routledge, pp. 22–26.
• Novović, M. (2017). Free Online Translation Services and Contractual Terms. Journal of Intellectual Property Law & Practice, p. 202.
• Personal Data Protection Law no. 6698 and the amendments made by Law no. 7499 – mevzuat.gov.tr