Compliance, calibrated to the stricter regime.

Certifications documents what Othello holds; Compliance documents how Othello operates. The certifications page lists 5 firm-level credentials (ISO 17100, ATA, ATC, GDPR, PDPA) and 15 bench practitioner credentials (AA1000AS, ISO 14064, GRI, IFRS S1/S2, FTSE Russell, and more), each verifiable on the issuing body’s registry. This page documents the operating discipline that the credentials underwrite — data protection in two regimes, NDA from first email, FAR-grade audit-trail, and sector-specific overlays. Both pages are independently verifiable under mutual NDA at procurement stage.

Othello applies the stricter standard for that engagement — not the easier one. For an EU→Thailand transfer with personal data, that means the modernised SCCs (Decision (EU) 2021/914) plus a Transfer Impact Assessment, plus Article 28 DPA, plus the PDPA Section 40 processor undertaking, plus the supplementary measures the TIA requires (encryption, minimisation, no consumer LLM endpoints). The breach-notification window aligns at 72 hours under both regimes; where the regimes diverge, the stricter applies.

Consumer AI endpoints are not compatible with Article 28 GDPR processor undertakings or PDPA Section 40. Their data-handling terms typically permit ingestion of submitted text into provider training and analytics pipelines — which means the firm cannot guarantee the limits Article 28 requires (purpose, retention, no sub-processing without controller consent, deletion at end of contract). Othello uses in-house translation memory, terminology databases, and CAT tools under processor control. This is operating discipline, not anti-AI ideology — the bench evaluates new tooling continuously; only data-handling-compatible tools enter the workflow.

FAR is the US Federal Acquisition Regulation — the procurement standard US Government contractors are vetted against. Othello was founded in 2020 on US Government bilingual contracts (US CDC, US State Department, UN Women, UK PACT) under that contractor-verification discipline. FAR-grade is the audit-trail and confidentiality standard Othello was set against from day one, and it remains the operating standard today — a Thai SET-listed corporate engaging Othello for an annual report gets the same audit-trail rigour a federal contracting officer demanded in 2020. It is a heritage standard, not a separately-certified credential.

It means the firm’s standing mutual NDA covers every inbound enquiry from the first email — before a quote is issued, before scoping, before any document is shared. Clients may execute their own NDA on top, which is then back-to-back to the bench. No document is reviewed under a “we’ll sign later” arrangement. If you send a confidential draft in the first email asking for a quote, it sits inside the standing NDA the moment it lands in the firm’s inbox.

No. The bench is named on every engagement record — translator, editor, reviewer identified by name before work begins. Where work involves any external linguist (rare; bench-first), back-to-back NDAs are executed and the chain is logged in the engagement file. No undisclosed marketplace sub-contracting, no anonymous freelancer routing. Counsel can verify each named individual’s NDA, ISO 17100 qualification, and language-pair coverage at procurement stage.

Retention is set per engagement letter against the matter type. Defaults: 7 years for standard translations, 10 years for sworn or ATA-certified work, matter-specific for litigation (often through the appeal window plus margin), as-required for capital-markets disclosure (per SEC Thailand and SET retention rules). Storage is Bangkok-side on processor-controlled infrastructure under PDPA, with the GDPR transfer mechanism on file for EU-origin data. Secure destruction on request and at end of retention; destruction certificate issued.

Othello operates a documented incident-response runbook with the 72-hour notification clock built in. On detection: incident logged, scope assessed, controller notified, regulator notification prepared (PDPC for PDPA matters, the relevant DPA for GDPR), affected data subjects identified, mitigation measures documented, post-incident report issued. Article 33 GDPR and PDPA equivalents mandate 72-hour notification to controller and regulator — that window is not negotiable. The runbook is available under NDA at procurement.

Yes, that is what the compliance pack is for. Under mutual NDA at procurement, Othello provides: standing NDA template, sample Article 28 DPA + SCCs, sample TIA, PDPA Section 40 processor undertaking, incident-response runbook, retention & destruction policy, named-bench register with credential cross-reference. Each line on this page is procurement-grade language — nothing is asserted that cannot be confirmed in a vendor-due-diligence file. Email [email protected] for the compliance pack.

The three pillars (data protection, confidentiality, audit-trail) and the four sector overlays (capital markets, healthcare, legal, government) are the operating floor for every engagement Othello delivers — ESG advisory, technical translation, certified translation, interpretation. Founded 2020 on US Government bilingual contracts under FAR-grade contractor verification, the floor is set higher than most translation firms’ ceilings. A client engaging Othello gets one engagement letter, one NDA, one audit-trail, and twenty credentials standing behind it. Email [email protected] or call +66 02-859-2145.