In reply to Lasse Kristiansen.

Our support asks for login when clients want us to check their site from inside the WordPress admin. You surely understand that this is not our first priority.

When clients need help checking things inside their site, we prefer that they create duplicates in our sandbox site. There, we can experiment as much as we want without the risk of breaking anything. When our debug completes, we delete these sites. We do that because we want to protect your privacy and because we have limited storage space on that sandbox site.

If clients give us login to their sites, we recommend to create temporary accounts and delete them when we’re done.

From this recent incident we also learned and we have already improved our workflow. We’re now auto-deleting private replies when tickets complete or get abandoned and we send reminder emails suggestion to clients to delete any private information that they shared with us. Yes, it would be nice if we had thought about it earlier, but we didn’t.

Nothing is to stop an employee from stealing data. If you don’t trust us and our employees, don’t give this access. There are ways to debug problems without giving us that access. For example, we offer live chat support. You can show the supporter what you are seeing and the supporter will guide you in real time.

How can you be sure of anything? We work remotely. Let’s say that we’re employing a crooked employee and he decides to damage both WPML and you. There’s nothing that will stop him. BTW, that’s the same about crooked policemen, crooked politicians (you do give them part of your income every month), etc. I hope you understand the stealing your data is not a company policy.

Our team has helped several hundreds of clients find what private information they shared with us so they can remove it from their site.

If we didn’t manage to help you better, I apologize. The recent hack to our server was our fault and not your and you have every right to be upset.