Every claim on this site is written down, with what backs it and how far it goes. That includes the parts we have not built.
This is unusual and it is deliberate. All three kinds of reader we care about — a consultancy deciding whether to recommend us, a platform vendor assessing a component, an integrator deciding whether it runs in their client's estate — will perform diligence whatever we write here. The only question is whether they learn where the edges are from us or from their own testing. From us, it is the reason to trust the rest. From their own testing, every other sentence on the site becomes suspect at once.
So the edges are here, on purpose, in the same table as the capabilities.
Four words do all the work, and the difference between the first two is the difference between a guarantee and an intention.
| What it means | What it does not mean | |
|---|---|---|
| Enforced | The software refuses the alternative. An operator who wants to switch it off cannot. | — |
| Configured | Somebody sets it, and the software honours what is set. | That it is on by default, or that a careless operator cannot set it wrongly. |
| Documented | A written decision governs it. Nothing in the software checks. | Any behaviour at all. It is a statement of policy. |
| Not built | Exactly that. | That it is coming. Nothing here carries a date. |
Enforced and Configured are not degrees of the same thing. An enforced control survives a careless operator; a configured one is only as good as whoever set it. Most vendors do not make this distinction in public, and a page that blurred it to make its own claims sound stronger would be worth nothing to the reader it was written for.
Nothing marked Not built appears anywhere else on this site.
| Claim | Status | What backs it |
|---|---|---|
| Confidential material a profile declared is replaced with an inflected stand-in — grammatical, and matchable downstream | Configured | The profile engine at the entity substitution point |
| Material the run's own scan discovers is replaced with a placeholder rather than a stand-in | Configured | A second transform composed at the same point. A stand-in that cannot be inflected or matched is worse than a placeholder, so discovered surfaces take the placeholder |
| A confidentiality check that cannot read the AI model's reply refuses, rather than reading it as "found nothing" | Enforced | The gateway rejects a reply its parser cannot read. The lenient parse that would salvage it is a defect by policy, not a missing feature |
| A truncated reply is detected rather than treated as a clean result | Enforced | Every live probe checks the completion reason before reading the content |
| An empty confidentiality snapshot is an inactive snapshot, not the absence of one | Enforced | A documented invariant, tested |
| Confidentiality invariants are specified, numbered and testable | Documented | Fourteen numbered invariants in the pipeline's plan of record |
| bAIbel TMS: the outgoing call is inspected, and a surviving confidential term refuses it | Enforced | The gateway throws; the engine records the run as refused with its reason. TMS only — see Boundaries |
| bAIbel TMS: the operator's own prose about the client's document gets stand-ins too — the summary, the project description, the cultural directives — and an unplaced marker refuses the call | Enforced | The section-translate stage carries them as client texts with their stand-ins, behind markers, never spliced into the instructions in the clear |
| bAIbel AV: every pathway that sends audits the AI request for leaked names before sending, records what it finds, and refuses the send on a hit | Enforced | Every such pathway, the agent console included; findings written with entry id, offset and a surrounding window, and the refusal names the terms |
| bAIbel AV: a profile that loads but protects nothing is refused, and the refusal says why | Enforced | The verdict is computed by running the real loader over the real file, never by a second, more tolerant reader |
| bAIbel AV: place names can be left in the clear to a chosen granularity, per project | Configured | A ladder from continent down to site; absent means every place name gets a stand-in |
| bAIbel AV: figures scaled to believable stand-ins, and contact details swapped for placeholders by rule with no model involved | Enforced | Percentages get placeholders rather than being scaled, because scaling changes what a percentage means. One factor preserves every ratio — it is not encryption |
| Claim | Status | What backs it |
|---|---|---|
| Exactly four facts about a provider are enforced, and only four: trust tier, registered region, an unexpired allow-list entry, and whether the instrument reaches raw content | Enforced | The provider eligibility decision and its assessment method. Everything else a data processing agreement says is invisible to the software — deliberately, because a field enforced on a basis nobody can produce is worse than no field |
| Client policy and the deployment floor are folded together, and the stricter wins | Enforced | The sub-processor policy fold |
| A residency conflict resolves to the floor | Enforced | Same |
| A lapsed agreement stops permitting anything | Enforced | Expired entries drop out of the allow-list |
| In-house providers are not exempt from the allow-list | Enforced | An explicit rule; a self-hosted model is a sub-processor decision like any other |
| Custody and legal basis are two axes, never one score | Documented | The eligibility ruling |
| Every enforced field ties to a clause somebody read | Documented | A written assessment method |
| Null means "not stated", never "everything" | Enforced | The policy discipline, carried into the qualification registry |
| Claim | Status | What backs it |
|---|---|---|
| A GDPR implementation, built and merged | Enforced | Eight numbered increments against a written specification |
| An Article 30 processing record | Enforced | Part of the same implementation |
| The delivery record distinguishes what kind of party received a document — filed where only the operator can reach it, collected by a person who signed in, or taken away by a third party's software | Enforced | The three destinations are kept distinct for the Article 30 export, because the recipient is not the same kind of party |
| "We produced nothing, deliberately" is a recorded outcome, distinct from "we lost your document" | Enforced | A check-only run still writes a delivery row |
| A HIPAA overlay | Configured | Eight numbered increments. |
| Regimes compose as a union, not as exclusive modes | Enforced | A flags enumeration: a deployment can be under two at once |
| Qualifications are recorded against a registry of instruments — a data processing agreement, a business associate agreement, standard contractual clauses, a training course — and a new one is addable without a deployment | Enforced | Deliberately between an enumeration and free text: the name the deployment registered |
| An instrument covers only the regimes it was explicitly registered as covering | Enforced | "None" covers nothing, rather than everything |
| EU AI Act Article 50(2): machine translation of a document is exempt; Recompose is in scope and marked | Documented + Enforced | A written decision, and a property the stage declares about itself — the first stage in the system to declare that it generates disclosable content |
| Erasure survives a restore: the ledger is captured before, replayed after | Enforced | Ledger export and replay verbs; proved by drill |
| Support bundles carry no configuration value — including one copied into a row somewhere | Enforced | Built from an allow-list, never a list of things to redact |
| A draft Data Processing Agreement exists | Documented |
| Claim | Status | What backs it |
|---|---|---|
| Machine translation works from the whole document rather than segment at a time — on both products | Enforced | Traced independently in each codebase. The unit sent is an authored section, sized by a measured policy on top of the document's own structure |
| The section travels with the document around it: the summary, the style, the section's discourse function, the glossary gathered over its segments, locked context, a window of previous translations, the run's cultural directives | Enforced | The rendered context map, named in the code's own comment |
| The operator's summary beats a generated one, and the generating stage skips itself when one was supplied | Enforced | Resolution order: operator, then the document's own, then nothing |
| Where a term is defined twice, the project glossary wins and the termbase citation is dropped before the request is built | Enforced | One source of truth for both forms of the glossary |
| Sections come from the document's own structure, not from a word count | Enforced | Per-format structure analysis; the word cap is a size guard on top of structure, not the thing that makes the cut |
| Formatting is read as what a paragraph displays, not what is written on it | Enforced | The full resolution chain — document defaults, the inheritance chain root-first, direct properties, the dominant run's style chain, theme fonts last — with the toggle properties XORed down the chain rather than overwritten |
| Target merge is by trans-unit identity, never by order | Enforced | The merge refuses to guess |
| Recompose: a structured tree, audited against the source, weighted for a named audience, from which fresh prose is generated — the source's wording never reaches the generator | Enforced | Ten numbered increments plus nine in the companion track |
| Audience and target language are run configuration for every workflow | Enforced | Twelve numbered increments |
| PDF is converted to Markdown or HTML and delivered as that. It is not parsed as a format | Enforced | The same doctrine was reached independently on both products |
| A workflow stage can pause for human judgement | Configured | Attended execution and resumable holds. See Boundaries — no stage asks a question |
| Segmentation covers 66 languages by rule; anything else falls back to English | Enforced | Nine full rule sets and 57 basic ones. On both products the file records which rules ran — see Boundaries |
| Inline-code integrity checking with no model in the path | Enforced | A separate deterministic component, its own test suite |
| Mandatory codes cannot be quietly dropped — a missing one fails the export validator, and the refusal says what to do about it | Enforced | Mandatoriness is element kind and code type together, stamped once and never re-derived |
| A table is translated as a table, resolved home by identity; a partial reply is refused rather than half-written | Enforced | Caps derived from 74 tables across 178 documents |
| Claim | Status | What backs it |
|---|---|---|
| Imports 28 formats and exports the same 28 | Enforced | The importer registry and the exporter factory. The list is published in full on the product pages |
| Opens and returns Trados and memoQ bilingual files, preserving inline formatting including formatting the translator added | Enforced | Four importer/exporter pairs; user-added formatting normalised to the canonical form for every rich exporter. See Boundaries — a bilingual file, not a project package |
| Translation memory is Lucene-backed, TMX in and out, with dual text representations and context-aware matching | Enforced | The entry model is documented |
| A person's approval takes a unit out of the partial-match band | Enforced | Pinned with the server at a shared commit |
| Agentic concordance search — the AI model composes the queries, Lucene does the retrieval, and whole-memory retrieval is structurally impossible | Enforced | Eleven tools; the caps live in the tool layer, not in the instructions, which is what makes the impossibility structural rather than requested |
| Agentic editing proposes changes the translator accepts or rejects per segment; nothing is applied silently | Enforced | A pending-edits sink and a per-segment review banner |
| AI-assisted terminology: the AI model proposes, the translator approves, and only approved terms go forward | Enforced | The target-side pass iterates the approved set only. Candidates persist, so a resumed run does not re-bill |
| Termbases, MultiTerm import under a policy, project glossary, term QA against the document | Configured | Script-aware tokenisation, including a character-based path for CJK, Thai, Lao and Khmer |
| Harmonisation View — segments sharing a source are grouped across every file in the delivery, each set marked as consistent, differing only in spacing or case, or differing | Enforced | The problem it names: two translations of one sentence sit hundreds of rows apart in different files, and the divergence is otherwise discovered by the client |
| Sub-segment harmonisation — shared phrases, not only whole segments | Enforced | Maximal token runs above a floor length, in two or more distinct segments, carrying at least one content word, excluding runs already rendered the same way everywhere |
| Near-match harmonisation asks whether the target differs beyond what the source difference explains | Enforced | Measured: over 183 diverging pairs on two annual reports, 13 survived |
| The obvious version of that feature was built, measured and refused | Documented | "Sources near-identical, targets differ" fires on 60–93% of every band below 100, and the divergence is mostly correct. Shipping it would have been a worklist that was ~90% correct work flagged as a problem |
| Two editing views — plain text with no codes in the way, or a formatted view where codes are typed, coloured chips — and crossing between them is guarded | Enforced | A reseed that preserves formatting the translator placed, and a confirmation on the way out once they have invested in it |
| Keyboard-first editing; grid filtering including a codes-missing filter; push-to-talk dictation in both views | Enforced / Configured | Dictation is a silent no-op with a one-shot explanation when speech recognition is not configured |
| PDF preparation is a separate step with its own provider choice, not a PDF importer | Enforced | A clean digital PDF, a scanned one and a forms-heavy one need different treatment at different cost, privacy and latency — so the choice is the user's |
| The provider and model registry is a published catalog refreshed at startup, not a hardcoded list | Configured | 13+ providers; structured-output capability declared per sub-provider; local additions have a durable home |
| The choice of model and provider is the translator's, and the API key stays on their machine | Enforced | Keys held in a local encrypted store. Self-hosted endpoints supported with keys optional |
| Every integration that receives document content carries a trust label the user owns — proposed from the endpoint's shape, confirmed by the user, and treated as External when unset | Enforced | The app suggests; the user confirms and owns. See Not built — the label does not decide where stand-ins are used |
| Profiles of names to protect are built and updated by a detection pass over real material, rather than hand-authored | Enforced | A profile is drafted from a pass, profiles merge, and the editor round-trips keys it does not own |
| Word count is CJK-aware, and it is the same rule the server uses | Enforced | Ported between the two products at the server's request |
| Windows only, today | Enforced | A WinForms shell hosting a browser control. macOS and Linux versions are planned, as a re-host; no date |
| Claim | Status | What backs it |
|---|---|---|
| Translation memory search is a pluggable strategy over Lucene, resolved request → memory default → deployment default → standard | Enforced | Four-level resolution that falls back rather than throwing |
| Context-aware matching: a full match is raised by one point per confirmed neighbour, walked in both directions, halting at the first failure | Enforced | Available context means both sides present, equal, and confirmed in this memory. It is a boost with a recorded magnitude, not a badge |
| Two candidates that both reach a full match break first on context, then on inline codes | Enforced | The tiebreaker runs over the code-bearing representation |
| Dedup-on-confirm requires document provenance — without it the server does not dedup rather than guessing | Configured | An opt-in directive on the request |
| TMX arrives and leaves in the dialect it came from | Enforced | memoQ and Trados normalisers written as pure inverse functions, a sniffer, per-export selection, and a contract version client and server pin together |
| Terminology in and out as TBX, MultiTerm and memoQ CSV | Enforced | Parser and exporter per format |
| Memories and termbases can be snapshotted | Enforced | A snapshot service for each |
| Seven built-in QA checks plus operator-authored rules, with a two-second regex timeout on custom rules | Enforced | Empty segment, inconsistent translation, numeric consistency, punctuation, tag integrity, terminology, whitespace. The timeout says somebody thought about a customer writing a catastrophic backtrack into a rule |
| Three reports — productivity, TM usage, project progress — exportable as CSV | Enforced | Exactly three. Named rather than implied, because a buyer eliminates on this page |
| Two people cannot edit the same segment at once | Configured | A lock with a five-minute timeout and re-acquisition on reconnect. Held by the running instance — see Boundaries |
| Nineteen stages, and registration is publication — a stage added to one list appears in the designer's palette and the builder's listing, with no schema change and no second table | Enforced | The stage set is one array |
| A stage describes itself completely, and no stage reads an option it never declared | Enforced | Asserted against the stage set the server actually runs, not a test's own |
| A stage's absence means absence — a workflow with no summarize or functional-role stage translates without them, and nothing silently defaults | Enforced | The renderer treats a missing field as though it were not there |
| What kind of run a definition is authored for decides which stages may appear in it — and the rule is written in terms of stage properties, never a list of permitted stages | Enforced | So a new kind of run gets a correct palette over stages written after it |
| When the designer does not offer a stage, it says why — one sentence, written once, used verbatim by the compiler | Enforced | Structural facts only, so it is safe to show |
| A definition republished while a run is in flight does not change that run | Enforced | Not the deliverable, not a hold, not the snapshot's policy |
| Feature gates default shut, admission gates default open, and the gate state is a ledger | Enforced | The two kinds are governed separately by the operational verbs |
| A gate shut on one node takes effect on every node within seconds, with no node-to-node traffic | Enforced | A five-second cache window, cleared on write so the node that took the decision acts on it immediately |
| An enforcing budget refuses a run whose cost cannot be computed — an unpriced model or an unconvertible currency stops it rather than admitting spend nothing can bound | Enforced | A budget cannot bound spend it cannot price |
| Enforcement applies a measured safety margin: the p90 of how wrong this workflow definition's own estimates have been, at this document size | Enforced | Taken from the variance sample recorded on every completed run. Quoting uses the raw estimate; only enforcement uses the padded one |
| The most restrictive budget wins, and the exhausted budget's own policy decides what happens — refuse, park, or wait for an approval | Enforced | With a recorded shortfall and a request path |
| A refusal names the budget and the arithmetic — remaining, of what, needed, and the multiplier applied | Enforced | A refusal nobody can act on is just an outage |
| Held money is released: a reservation expires, and a run parked because a budget was exhausted does not squat on the money it waits for | Enforced | A reservation time-to-live |
| No enforcing budget means no gate — the small-team path is not taxed by machinery it did not ask for | Configured | An explicit path, not an oversight |
| A budget is scoped to the deployment, a provider's pool, a client or a project, over a calendar month, a calendar quarter, a rolling window, a fixed period, or no period at all — and advisory budgets promise reporting, never bounds | Enforced | Advisory never refuses, reserves or parks |
| An admitted run reserves what it needs, so two runs admitted in the same instant cannot each spend the same balance | Enforced | Spent plus reserved plus estimate must fit; admissions serialize. The portal and the agent door make the race real rather than theoretical |
| The gate bounds expected spend; a running meter bounds actual — and overshoots by whatever was in flight when it tripped | Enforced, and the limitation is the claim | A call already in flight when the ceiling trips is going to be billed. The codebase's own instruction is to state that rather than pretend otherwise |
| A cost reading that could not be taken is recorded as a flagged gap, never as a zero | Enforced | An explicit unmetered outcome on the throw path |
| Three independent intake doors — a project manager uploads, a client drops off through their own portal, another company's software delivers — all converging on one pipeline | Enforced | Two built pathways plus the agent door, manual pass complete |
| A client-facing portal whose entire dependency surface is two packages, as a security decision | Enforced | react and react-dom. Nothing else is served to people outside the customer's company |
| An agent-facing door accepts files without the bytes travelling through the AI model | Enforced | Ten numbered increments; the document moves between systems, not through a context window |
| A self-describing bilingual file's own language pair wins over the form | Enforced | Fixed a real defect: a file saying English-to-French was admitted as English-to-German and translated into the wrong language with no layer objecting |
| A notice channel reports failure rather than swallowing it — an undeliverable notice stays owed, and a transient failure is distinguished from a hopeless one | Enforced | Accountability otherwise evaporates at the first broken connection |
| A notification carries no reason — it names the run and where to look | Enforced | A failure reason can carry an exception message and a gate reason names what a detector found inside the client's document. The message points at the run; the run tells whoever signs in everything |
| An escalation says why somebody who did not ask to hear about it is being told | Enforced | An escalation level on the message |
| The assignment list is filtered by language capability for that task type and by qualification standing against the client's engaged regimes, then ordered by capability and by measured workload | Enforced | An unmeasured queue sorts last, not first — a fixed defect recorded in the source. See Boundaries |
| A disabled or erased account leaves the candidate list; somebody who fumbled three passwords does not | Enforced | An explicit branch, written out rather than left to the query translator |
| Recompose arrives inert on every installation — registered, visible in the palette, and gated at the act | Enforced | Registration is publication; the gate decides whether it ever runs. An administrator opens it |
| Recompose may only be given a source an importer says survives being read as prose | Enforced | The compiler projects the format list from the importers; nothing in the stage names a format |
| The verbatim-overlap threshold must be authored — it no longer falls back to a shipped default | Enforced | A gate that reads as applied and never applies is the failure it was changed to prevent |
| A substantial REST surface | Enforced | 54 controller files, including the agent and portal groups |
| Refusals are distinguishable: an exhausted budget, a confidentiality refusal and a misconfiguration each carry their own sentence | Enforced | A documented contract on the brokered completion door |
| Brokered completion — a caller hands over the request instead of the credential, and trust tier, residency, the client's allow-list, stand-ins for confidential names and server-side metering all become true of that call | Enforced | A dedicated controller and dispatch service |
| Claim | Status | What backs it |
|---|---|---|
| One instance per client organisation | Enforced | The deployment model and its provisioning runbook |
| Four images at one version, upgraded together | Enforced | The API address is runtime configuration, not baked into a build |
| The application never migrates itself; only the migration verb holds schema rights, and the guard refuses both Behind and Ahead | Enforced | Ahead is the one people forget: a rolled-back service against a migrated database is the failure that loses data rather than throwing an error |
| Every migration declares its impact; anything above a backfill requires explicit acceptance by name | Enforced | An attribute on the migration and a flag on the verb |
| The same image runs the operational verbs — preflight, schema status, impact, drain, admission gates, backup status, diagnose, ledger export and replay | Enforced | Forked before the service starts |
| Backups are a ledger that records failures too | Enforced | A backup that did not happen is a row saying so |
| Restore is proved by drill, not asserted — including reading the count of errors the restore ignored | Enforced | Green after six runs, which found six real defects. The drill never restores over the database that records it |
| An installation has a name; cross-instance restores are detected as foreign or mixed | Enforced | The backup claims its destination |
| Nothing in TMS schedules a backup | Documented | A scope boundary, stated rather than omitted |
| On-premise: we prescribe, provide and verify nothing about backups, and no telemetry reaches us | Documented | A published scope. Anything that phoned home would contradict it |
| Without a document renderer, a run requiring one is refused at admission rather than failing after the translation has been paid for | Enforced | A startup probe and an admission refusal |
| On-premise image distribution with the renderer as a named prerequisite rather than a bundled binary | Configured | Two build stages rather than a conditional, so the image never carries the bytes. The operator installs it and points the configuration at it |
| bAIbel Technologies Limited, registered in England and Wales | Company number 09639418 |
| Registered office | 69 Loughborough Road, Bradmore, Nottingham NG11 6PA |
| VAT | 525 2687 80 |
| ICO registration | ZB816348 |
| bAIbel TMS | In development |
| Not built | What that means in practice |
|---|---|
| Per-run confidentiality attestation | Attestation is a definition-time statement. There is no per-run attestation record, and "every run is attested" is a sentence you will not find on this site |
| Single sign-on | Staff join by invitation. SSO waits for the customer who needs it |
| A published, versioned API contract | The API surface is deliberately unversioned and releases in lockstep with the front ends. For an integration partner this is a genuine gap, and we would rather say so before a meeting than during one |
| A stage that asks the operator a question mid-run | A stage can pause for human judgement. No stage in the engine asks a question. One sentence apart in English, a demonstration apart in reality |
| Live progress pushed to the browser | Progress is durable and readable. The push channel is designed and deliberately deferred |
| bAIbel TMS: figures scaled to stand-ins | The server replaces amounts with a reversible placeholder. A run naming a scaling profile is refused rather than silently running the token transform under the profile's name. The desktop has the scaler |
| bAIbel TMS: a qualification gate on assignment | The candidate list is computed against the client's engaged regimes and shows who is qualified. Nothing refuses an assignment made anyway. The list informs; the manager decides |
| bAIbel AV: segment status on the return trip | Corrected 2026-09-30, and it had been wrong for months. Content and confirmation status round-trip through Trados and memoQ bilingual files: a confirmed segment returns confirmed, in each tool's own vocabulary. This page said the opposite from 2026-05-16 until today, because the register row was never revisited after the fix landed on 2026-06-21. The live evidence is the review pair against memoQ 12.5.20 and Trados 2024; the ordinary export rests on the code path and its vocabulary tests |
| bAIbel AV: the trust label deciding where stand-ins are used | Every integration is classified, recorded and badged, and the outbound policy is computed with a human-readable reason. Nothing consumes that policy yet. Classification is real; automatic stand-ins for external endpoints are not |
| bAIbel AV: declining a row in a profile | Profiles are built from a detection pass and edited — rows added and amended. There is no decline, and a pass does not record what it excluded. It is not a full accept-and-reject review |
| A single self-contained on-premise image | The renderer is a named prerequisite. Shipping it inside the image raises a licensing question about the scope of the accompanying source offer, and that question is unanswered. |
The two products do not have the same confidentiality posture, and the difference is the important part. bAIbel TMS inspects the outgoing call and refuses it if a confidential term survived. bAIbel AV audits every AI request, records every leaked entity with its position, and refuses the send — since 2026-09-30 (76afa3d5, 7b7f9823). Both products fail closed (when a safeguard cannot do its job, the request is refused rather than sent), and since 2026-10-22 the desktop refuses a profile that loads but protects nothing as well. This page said the opposite until 2026-09-30. one product's posture to "bAIbel" is wrong about one of them.
A bilingual file is the unit, not a project package. Trados and memoQ bilingual files open and return. There is no handling of Trados project packages, and "works with Trados packages" is a sentence we cannot write.
There is no callback when a run finishes. Notices are delivered by mail, with failure reported rather than swallowed. A platform partner asking whether we can call their system back is told no.
There is no user delete, by design. The identifier is a foreign key throughout the system. Offboarding disables; erasure anonymises and keeps the row. This is a deliberate design decision and it is the right one, but it is not what "delete my account" usually means.
Neither disabling nor anonymising an account ends an already-issued access token. A real boundary, and a diligence reader will find it.
Geography is enforced at profile granularity, not per entity. The place-name cut is a property of the profile applied to a project, not a decision taken per occurrence.
Segmentation outside its 66 languages falls back to English. Nine languages have full rule sets and 57 have basic ones — punctuation, decimals and common abbreviations, without the exceptions a full set carries. Any other language is segmented with English rules. On both products the file records which rules ran, and the desktop says so when it imports.
The segment lock is held by the running instance. Two people cannot edit the same segment at once, under the one-instance-per-organisation model. It is not distributed locking, and if the deployment shape ever changed, this claim would change with it.
Three reports, not a reporting suite. Productivity, translation-memory usage, project progress, exportable as CSV. Named here so it is not discovered on a demonstration.
Automated work is gated at the points where it enters the deliverable — but the tool does not force a review. Proposed edits are accepted per segment; terms are approved before they are used; a missing mandatory code refuses the export. What is not enforced is review itself: export gates on errors, not on review status, so a translator who wants to machine-translate and export can. It is built to be used with a person in the loop. It does not make you be one.
Recompose is switched off when it arrives. On every installation, including yours.
A too-similar Recompose section is measured and reported, not stopped. The verbatim-overlap check raises a finding. It does not refuse the run.
Windows only, for the desktop, today. macOS and Linux versions are planned, as a re-host rather than a port. There is no date.
This page is a summary of a longer document we keep for ourselves: the same claims, with the file, the type or the decision record that substantiates each one, and the rows that failed — claims we considered making, traced, and found untrue.
That document goes to anyone performing diligence, under a confidentiality agreement. So does a technical contact who can answer from the source rather than from a brochure, and the draft data processing agreement.
We would rather be read carefully than read widely.
