In 2023, Samsung engineers pasted proprietary source code into ChatGPT to check it for errors. The code could then be used to train OpenAI’s models, which could expose it to other users, including bad actors. Samsung had no way to remove it, and banned staff from using generative AI tools for three years.
Translation poses a similar risk when an employee pastes a confidential document into a public AI tool like ChatGPT. A ban on its own rarely stops employees who need a quick translation. The answer is secure AI translation, which is a fast, approved option that doesn’t train on your content, stores data where you choose, and proves its security with independent audits.
In this article
-
Why are employees translating confidential documents with ChatGPT?
-
What are the risks of using public AI tools for translation?
Why are employees translating confidential documents with ChatGPT?
Using an AI tool a company hasn’t approved is called shadow AI, and it’s common. Software company PagerDuty ran a 2026 survey on AI use at work. Of the office workers surveyed, 66% said they had used AI tools even though they believed company policy didn’t allow it, and 88% had shared work information with public AI tools.
The survey didn’t ask about translation specifically, but shadow AI translation is an easy habit to fall into. Employees usually turn to public AI tools for one of three reasons:
-
The official process is slower. A request to the localization team or an agency may take days, but a public AI tool translates the text almost instantly.
-
They don’t know there is an official process, or who to ask.
-
They don’t see the risk. Pasting text into a translation box feels like a quick way to understand a document, so few people think of it as sharing company data.
What are the risks of using public AI tools for translation?
Translation workflows handle some of a company’s most sensitive material, including HR files with personal data, M&A agreements and marketing campaigns for products that haven’t launched yet. When any of it is pasted into a public AI tool, three things can happen:
-
It may be used for training. OpenAI, for example, says it can use content from its consumer services, such as ChatGPT, to train its models unless users opt out. Its business versions are excluded by default.
-
It’s stored on someone else’s servers. Many cloud-based tools store files in data centers in several countries with different legal systems, and your company can’t decide where the text is kept or for how long.
-
There’s no record of what was shared. Without a log of which documents went where, it’s hard to respond to a data request, an audit or a leak.
Why isn’t a ban on public AI tools enough?
Policies alone don't change behavior, as the PagerDuty survey shows. An employee who needs a document translated before a meeting still needs it translated, ban or no ban.
Damien Saby, Product Marketing Lead at memoQ, says a ban is still needed, but without an alternative it can make things worse:
“You can ban these tools, and you should, because they pose real risks. But you can’t ban them without providing an alternative. People still have work to get done, and if you take away the tools they know, they’ll find ones that are even less controlled.”
The underlying issue is speed. As long as the approved route is slower than a public AI tool, people will keep taking the shortcut. Employees also need to understand why the ban exists. Someone who knows that a pasted contract can end up in an AI model’s training data has a good reason to use the approved route.
What makes an AI translation tool secure?
AI translation security comes down to three tests. Before you approve any tool, check that it passes all of them:
-
No training on your content. The vendor confirms in writing that it doesn’t use your content to train its models or anyone else’s.
-
Control over where your data is stored. You can choose the hosting region or host the system yourself, and you know which providers process your content.
-
Independent proof that security controls work. Any vendor can describe its security, but third-party audits such as SOC 2 Type 2 and ISO 27001 check whether it works.
What’s the difference between SOC 2 Type 1 and Type 2?
SOC 2 is an audit framework developed by the American Institute of CPAs (AICPA). As Ádám Klár, Chief Information Security Officer at memoQ explains in this podcast, an independent auditor reviews a company's controls in areas such as security, availability and confidentiality, and produces a report that customers can read instead of sending long security questionnaires.
-
Type 1 checks whether controls are designed properly at one point in time.
-
Type 2 checks whether those controls work consistently over a period, such as three, six or twelve months.
If a vendor has an incident response policy, a Type 1 auditor may review the policy and a few examples. A Type 2 auditor looks at how every incident in the audit period was handled. For translation tools, which process confidential files every day, a SOC 2 Type 2 report gives a clearer picture of whether security works in practice.
ISO/IEC 27001 is the international standard for information security management. It sets out a framework for managing security risks, while SOC 2 is more specific about the controls a company needs.
Questions to ask any AI translation vendor
-
Is our content used to train AI models, either yours or a third party’s?
-
Where is our data stored, and which AI providers process it?
-
Can we see your SOC 2 Type 2 report and ISO 27001 certificate?
-
Is there a record of what was translated, by whom and when?
-
Does a person review high-risk translations before they're used?
Which translation route should your content take?
Not every document carries the same risk, so confidential document translation needs a different route from everyday content. Which content goes on which route depends on the company and its industry.
Route 1: Everyday content
An internal email written in French for an English-speaking colleague usually just needs to be understood, so it doesn’t need a professional translation. For this kind of content, give employees an approved enterprise AI tool that they can use themselves, such as Fluent. Whichever tool you choose, check it against the three tests above before you roll it out.
Route 2: High-visibility and high-risk content
Content like contracts, HR documents, product plans and customer-facing material should go to the localization team. Here’s how that works with memoQ AGT (Adaptive Generative Translation), which runs inside memoQ TMS, a translation management system:
-
The employee sends the document to the localization team.
-
The project manager sets up memoQ AGT for pre-translation. In the TMS, project templates define when memoQ AGT is used. This short video shows how it works.
-
memoQ AGT creates a first draft. memoQ AGT combines a large language model with your translation memories and term bases. Because it reuses these resources, model training isn’t needed and the draft follows approved terminology from the start. Note that the quality of memoQ AGT’s drafts depends on the localization team keeping its translation memories and term bases up to date.
-
A linguist reviews and approves it. memoQ requires this step before memoQ AGT output is used, which is why memoQ AGT suits content where a mistranslation has legal or reputational consequences.
Speed: Fondation suisse de déminage (FSD), a Swiss humanitarian organization, completed translation and review almost 2.5 times faster with memoQ AGT while keeping terminology consistency close to 100%. In a separate example, a large enterprise customer cut project turnaround times by 37%, saving an average of 2.8 working days, and memoQ AGT used the required terms 90–95% of the time.
Security: Data processed by memoQ AGT is neither stored nor used to train any model. It passes through Microsoft Azure OpenAI for processing and is then deleted, with no human review by Microsoft.
Data residency: memoQ AGT can be hosted in Europe, Canada and other regions.
As Damien puts it, “When you use a tool like memoQ AGT, you know that your data is not going to show up anywhere outside your control.”
memoQ doesn’t see or collect customers’ translation content, and companies can run memoQ TMS on-premises to keep the application and their data on their own servers. Within a company’s own memoQ TMS, the project history records who did what and when, and reporting tools such as Business Analytics give teams the data they need for audits.
As Deutsche Bahn says in its memoQ success story, “We want to keep control over our data throughout the entire translation process.”
How does a public AI tool compare with memoQ AGT?
Here’s what happens to each risk with a public AI tool and with a localization team using memoQ AGT.
|
Risk |
Public AI tool |
Localization team with memoQ AGT |
|
Confidential content used to train AI models |
Possible, depending on the tool and account type |
Not used to train any model, and deleted after processing |
|
Data stored where your company can’t control it |
Stored on the AI provider’s servers, usually in a location you don’t choose |
You choose hosting in Europe, Canada or other regions, or run memoQ TMS on-premises |
|
No record of what was shared |
None for your company |
Project history and reports in your memoQ TMS show who did what and when |
|
No independent verification of security |
Varies by tool |
SOC 2 Type 2 compliance and ISO 27001 certification |
|
Inconsistent or off-brand terminology |
Generic wording that may not match your approved terms |
Follows your approved terms, using your translation memories and term bases |
|
Errors in high-risk content go unchecked |
No review step |
A linguist reviews and approves memoQ AGT output |
Why choose memoQ for secure AI translation?
memoQ’s Language Suite brings AI translation into the workflow your localization team already uses, instead of sending content to a tool outside it. memoQ AGT uses your translation memories and term bases to follow your approved terminology, and a linguist reviews the output in the same system. Your content isn’t stored or used for training, and you can choose where it’s hosted or run memoQ TMS on your own servers.
memoQ’s security is something your team can verify. memoQ holds ISO 27001 certification and announced SOC 2 Type 2 compliance in January 2026. Its Type 2 report shows how the controls that protect your confidential content performed over months, so you can review them before signing a contract.
Make the fast route the secure route
Employees will keep using AI to translate. Give them an AI tool your security team has approved for everyday content, send high-risk content to the localization team, and make sure both are fast enough that nobody needs a workaround.
Your employees are already translating with AI. See how memoQ AGT keeps your confidential content secure. Book a consultation or visit the memoQ Trust Center to learn more.
Frequently asked questions
Shadow AI translation happens when employees use AI tools their company hasn’t approved, such as ChatGPT, to translate work content. It’s usually because a public tool is faster than the official process, but it can send confidential content outside the company’s control.
It can be, if the tool doesn’t train on your content, lets you control where data is stored, and has independent audit evidence such as SOC 2 Type 2 and ISO 27001. High-risk content should also be reviewed by a professional linguist before it’s used.
For non-sensitive text, ChatGPT or another public AI tool may be fine. For confidential content, such as contracts, product specs or HR files, use a translation route your company has approved, so you know where the data goes and how it’s protected.
SOC 2 Type 1 reviews whether a company’s security controls are designed properly at one point in time. SOC 2 Type 2 checks whether those controls work consistently over several months. For translation tools that handle confidential content every day, a Type 2 report gives stronger evidence that security works in practice.
Yes. memoQ announced SOC 2 Type 2 compliance in January 2026, covering its security, availability and confidentiality controls. It also holds ISO 27001 certification. Details are available in the memoQ Trust Center.
AI translation Translation Security Data Security
Mimi Moore
Mimi Moore has over 20 years of experience in globalization and localization, from managing translation projects to leading in-house content marketing. In 2021, she founded Wolfson House Writing, a Netherlands-based content marketing agency for language services and language technology companies. She volunteers as Senior Manager, Brand and Content at Women in Localization and regularly contributes to MultiLingual Magazine. For memoQ, Mimi writes about AI translation, data security and TMS integrations. Off the clock, she loves exploring new cities and hunting for buried treasure in used bookstores.
