SoSafe's localization team is two people. They ship content in 34 languages to organizations across Europe, Asia, and Australia. Today, with Lingo.dev, a complete retranslation of 90+ lessons across every language takes a single day.

This is not a story about a tool migration. It is a story about what happens when a team stops treating localization as a vendor relationship and starts treating it as infrastructure.

"I like that Lingo.dev's localization infrastructure is AI-first from the ground up. We went from six months per release to one sprint across 34 languages – and we talk directly to the engineers behind it."

– Max Höffner, Director of Product Engineering, SoSafe

The product demands it#

SoSafe is the fastest-growing platform for adaptive human risk management, trusted by over 6,000 organizations worldwide to build human resilience as risks evolve. Grounded in behavioral science and powered by community intelligence from real threats and behaviors, the platform turns everyday interactions into opportunities for adaptive learning. Content precision, accuracy, and relevance is key to ensuring training and learning is impactful. Ensuring the right legal terms are used for a specific jurisdiction strengthens the overall credibility of GDPR training. Phishing simulations have to feel real to create a learning moment.

"We take a lot of pride in our in-house content," says Max Höffner, Director of Product Engineering at SoSafe. "In Germany, you would always use formal language. In Switzerland, they tend to use the informal version, even in official training. This is where high-quality localization becomes a product quality question – not a nice-to-have."

Content relevance and quality is one of SoSafe's competitive advantages. Their simulation emails need to reference local institutions. Their compliance modules need jurisdiction-specific regulatory language. A generic translation is worse than no translation – it trains employees to recognize the wrong cues.

What did enterprise localization look like before AI?#

Before 2025, SoSafe's localization workflow looked like most enterprise localization setups: legacy TMS, external translation agencies for execution, and a painful manual process connecting the two.

Annika Palm, Localization Engineer at SoSafe, describes her previous role without nostalgia: "File management was probably about 90% of my job. Not terribly exciting, not terribly fun, but it had to be done. We had to do file transfers mostly via email. Files were sometimes lost in the communication. File versioning was often an issue because we didn't have Git."

The workflow for a single lesson: duplicate a project file, open it in the authoring tool, double-click each string, paste in the translated text from the agency, save, export, upload. For every language. For every lesson.

We discovered that quality control only covered the languages someone on the team could actually read. For the rest, there was no measurement at all.

"Translators often don't have the domain-specific knowledge," Annika says. "Their translations were good enough, but they were not as good as they should have been for us."

When does a legacy TMS stop working?#

The shift happened at a structural level – SoSafe migrated their content architecture to JSON files in Git repositories, replacing the proprietary authoring-tool format. Once content lived in Git, the question became obvious: why does localization live outside this pipeline?

Max Höffner saw the same pattern he'd seen across the industry: "The problem with all of the established players is they were just adding AI features on a process that was, in my opinion, already broken. Some of them had GitHub integration, some had this or that. But what Lingo.dev did differently is they thought through localization AI-first from the ground up. And because of how their team is set up, we talk directly to the engineers building the infrastructure. Edge cases get resolved the same day."

The team evaluated three or four alternatives. Each offered some version of the same proposition – the legacy TMS workflow, now with an AI layer bolted on top.

"I remember having that conversation with our CTO," Max says. "I said: the established players are adding AI to the end of a broken process. Some offered AI as an intermediate step while they work on the human version. And I thought – well, can't we just make the AI version better?"

How does a localization engine replace translation agencies?#

Today, SoSafe's localization runs through a set of localization engines configured with 4,417 glossary terms, professional style guides per locale, per-locale instructions for formal/informal register, terminology preferences, and regulatory language.

The technical workflow: content lives in a Git repository as structured JSON. Localization runs as a CLI command.

"We have one shared source of truth," Annika says. "Everyone knows that the version on GitHub is the version that should be on the platform. No one has to search for files. No one has to ask, is this really the live version?"

The glossary enforces terminology across every language pair – GDPR-specific terms, cybersecurity vocabulary, product-specific language. After configuring the localization engine with 4,417 glossary terms, the team found that terminology consistency across all 34 languages reached measurable levels for the first time. Issues that previously took weeks to surface through customer complaints now get flagged within minutes. When a score flags an issue in Swiss German because a glossary term was missing, Annika adds the term and it retranslates. Annika's average resolution time turned out to be eight minutes from alert to fix – Max Höffner's favorite metric.

The concerns that almost stopped them#

Annika's biggest fear was losing control: "Our content is seen by thousands of people every day. We get complaints almost every day. If we had put ourselves in a position where we translate faster but have less control over the output, that would not have been good for us."

What changed her mind was the configurability of the localization engine – glossary, translation rules, brand voice, per-locale instructions. "You could interpret it almost like an engine is a translator," she says. "The translator has a glossary at hand, is given translation rules, and should have knowledge of the product. The engine has all the knowledge packages a translator brings to the table, but condensed and more reliable."

The GDPR review was the other potential blocker. SoSafe is a German cybersecurity company – procurement involves ISM, legal, IT, finance, and multi-level management approval.

Max Höffner's approach: scope the data flow. "As long as we control the data that goes into the system, we have control over the GDPR side of things. Everything that is PII we just do not send. For everything else – our own training content, our internal materials – we can proceed." The DPA was signed, legal cleared it, and IT confirmed. The question was never whether AI localization was compliant – it was which content fell inside the boundary.

How fast can a team ship 34 languages simultaneously?#

All 34 languages ship simultaneously. The production cycle – from final German content to all languages live – dropped from months to just one sprint.

"We don't need a tier system anymore because it is irrelevant whether we translate into one language versus thirty languages at the same time," Sheree says.

We measured the shift: a new language release is now taking just one sprint end-to-end. For the first time in years, localization is not the production bottleneck anymore. "The bottleneck shifted to other engineering processes – database entries that need updating, manual steps elsewhere," Max Höffner says. "It basically shifted the whole bottleneck conversation away from the localization team where it has been for the last several years."

The most revealing proof point came from a product team building an AI-generated lesson feature. The team asked Max how to handle localization for customer-uploaded PDFs that generate lessons in different source languages. His answer: "Use Lingo.dev." They implemented it in a single day – something that would have required a dedicated sprint under the previous model. "We didn't have to think about this much," he says. "The team asked me, and we implemented it from day one."

What does a localization engineer actually do?#

Annika's job title hasn't changed, but her work has. "I'm more of an engineer now in every sense of the word," she says. "We no longer rely on other people to help us. We can be more proactive. Before, we had to rely on dev engineers. Now we can create our own solutions."

The shift is from operational to architectural. Instead of managing vendor email chains and copying strings into files, the team configures engines, tunes glossaries, monitors quality scores, and builds automation scripts.

"Now we are the solution providers ourselves," Annika says. "Our processes are a lot leaner. It's focused on solutions, whereas before it was managing people who provided the solutions."

When asked what she'd say to a localization engineer worried that AI workflows will diminish the role: "The knowledge stays with us – what quality looks like, what needs translating, for what audience. When we hand the boring parts to AI localization infrastructure, we solve important problems faster."

What's next#

SoSafe is rolling localization infrastructure out to every product team. Sheree calls the model "centralized decentralization" – her team owns governance, quality standards, and engine configuration. Other teams execute localization autonomously within those guardrails.

"Each team can work more autonomously because we are providing the overarching infrastructure for them," Sheree says. "They don't need us to intervene anymore. They can trust that the information from the engine is at the standard it should be, and execute in their normal development cycle without blockers."

Two people, thirty-four languages, quality governance across every product – without vendor coordination or waiting.

What this means for localization teams scaling beyond 10 languages#

SoSafe's experience surfaces a pattern across teams that cross the 10-language threshold: the legacy model of TMS + translation vendor breaks at scale not because translation quality degrades, but because coordination cost grows faster than content volume. Three things changed the equation: glossary enforcement eliminated terminology drift across all 34 languages without human review per pair. Quality scoring made every language measurable – not just the ones someone on the team speaks. And the localization engineering workflow moved ownership from vendor project managers to the team that ships the product.

The result is a shift in who does what. Translation agencies provided labor. Localization infrastructure provides capability. The two-person team at SoSafe now governs more language output per quarter than the previous two-person team plus four vendors produced per year.

In their words#

Max Höffner, Director of Product Engineering, on whether to treat localization as infrastructure:

"Infrastructure all the time. It should always be infrastructure. In this day and age, localization isn't a human-reliant process anymore."

Sheree Foltin, Content Engineering Teamlead, on recommending the shift:

"I would recommend revamping the process so the humans employed can actually focus on what matters."

Annika Palm, Localization Engineer, on the legacy model:

"The TMS-and-vendor model is a dying model, to put it bluntly. In the fast-moving world we are in right now, it won't be able to adapt fast enough."

SoSafe is the adaptive human risk management platform that helps organizations unlock human resilience at scale – combining behavioral science, global community intelligence, and AI to stay ahead of evolving threats. Their localization infrastructure runs on Lingo.dev.

Frequently asked questions#

How many languages can a two-person localization team support?

SoSafe's two-person team ships 34 languages simultaneously using localization engines configured with per-locale glossaries, brand voice rules, and AI quality scoring.

How long does it take to add a new language with a localization engine?

At SoSafe, a complete retranslation of 90+ lessons across a new language takes one day. The acceleration comes from glossary enforcement and per-locale model configuration running through a CLI, not from cutting corners on quality.

What does a localization engineer do differently from a localization manager?

SoSafe's Annika Palm describes the shift: the role moved from managing vendor relationships and file transfers to configuring localization engines, tuning glossaries, monitoring quality scores, and building automation. The team went from managing people who provided solutions to being the solution providers themselves.

How do you measure translation quality in languages you don't speak?

SoSafe uses AI quality scoring – independent models that evaluate each translation against configured criteria. They've run 240,000+ scorer evaluations across the platform. When scores flag an issue, the localization engineer adjusts the glossary or instructions and retranslates. Average resolution time: eight minutes.