GATE Subprocessors
v1.0Last updated: 2026-06-01
A subprocessor is a company we use to deliver part of GATE. This page lists every one of them, where they sit, and how the data transfer is protected.
If you have a question about a specific subprocessor, email [email protected].
Current subprocessors
| Subprocessor | Location | Opt in / out | DPA in place |
|---|---|---|---|
| Anthropic | United States | Standard | Yes |
| OpenAI / Codex | United States | Standard | Yes |
| OpenRouter | United States | Standard | Yes |
| z.ai | China | Opt-in | Yes |
| Mistral | France | EU package | Yes |
| Composio | United States | Standard | Yes |
| Hetzner Cloud | Germany and Finland | Standard | Yes |
| Cloudflare | United States with global edge | Standard | Yes |
| ElevenLabs | United States | Opt-in (voice) | Yes |
| Stripe | Ireland (EU entity) with US parent | Standard | Yes |
| Brevo | France | EU package | Yes |
| Postmark | United States | Standard | Yes |
A note on z.ai (China)
z.ai is the only subprocessor on this list located in China, and it is off by default. Your chat never goes to z.ai unless your organization explicitly turns it on in your settings. If you leave it off, no data crosses into China. We built it as a per-organization switch precisely so a company that cannot send data to China simply never does.
A note on Composio (your tokens)
When you connect Gmail, Calendar, Drive, or another service, the OAuth token that grants access is held by Composio, our integration provider, not on GATE’s own servers. GATE stores only a reference to the connection. When you delete your account or disconnect a service, the token is revoked at Composio.
Transfer mechanism
For every subprocessor outside the EU we rely on the European Commission’s Standard Contractual Clauses (SCCs, Decision 2021/914) and, where the subprocessor offers them, additional technical safeguards like encryption in transit and at rest.
Changes to this list
We give 30 days notice before we add a new subprocessor. Notice goes out by email to the account address on file and is also posted at gate.software/legal/subprocessors. If you object to a new subprocessor for compelling data protection reasons, you can close your account before the new subprocessor goes live and we will refund any unused prepaid balance.
We may make changes faster than 30 days only in two situations: a security emergency where swapping providers protects user data, or a legal obligation that forces a change. In those cases we notify users as soon as we can.
Contact
Gate Intelligence AB Ankargränd 2, 111 29 Stockholm, Sweden [email protected]