GATE Subprocessors
Every company we use to deliver GATE, what they do, where they sit, and how the transfer is protected.
A subprocessor is a company we use to deliver part of GATE. This page lists every one of them, where they sit, and when your data reaches them.
If you have a question about a specific subprocessor, or want the data processing terms we hold with one, email legal@gate.software.
Current subprocessors
| Subprocessor | Location | When it is used |
|---|---|---|
| Anthropic | United States | Chat and code sessions |
| OpenAI | United States | Codex models when someone picks one; images, video and voice that run on OpenAI |
| z.ai | China (Singapore entity) | Chat fallback when Claude is unavailable, only if your organization turns on providers in China |
| Moonshot (Kimi) | China (Singapore entity) | Kimi models, only if your organization turns on providers in China and providers that may train on your data |
| Google (Gemini) | United States | Transcription, live speech in GATE Meet, images and video |
| TypeSafe | United States | Checks the quality of bot replies |
| Higgsfield | United States | Video generation, only if your organization turns on providers that may train on your data |
| ElevenLabs | United States | Voice, if you use it |
| Composio | United States | Holds integration tokens |
| Decodo | Lithuania | Browser proxy, if your organization picks it |
| Hetzner | Germany and Finland | Hosting, database, backups |
| Cloudflare | United States with global edge | DNS, CDN, WAF |
| Stripe | Ireland (EU entity) with US parent | Payments |
| Postmark | United States | Transactional email |
| GitHub | United States | Repository access for code sessions and site builds, when you connect a repository |
| Apple | United States | Push notifications to the GATE iPhone app, when you install it |
Providers your organization decides on
Two switches under Settings > Organizations decide which of these providers your data can reach. Both are off by default, and only an organization owner can turn them on.
- Allow providers in China. z.ai and Moonshot (Kimi) are owned from China. With this off, GATE never sends your data to them, not even as a fallback.
- Allow providers that may train on your data. Higgsfield and Moonshot may use what they receive to train their models. With this off, GATE never sends your data to them.
Our Data Processing Agreement lists every subprocessor with its transfer mechanism and whether it trains on data.
A note on Composio (your tokens)
When you connect Google, Microsoft or most other services, the OAuth token that grants access is held by Composio, our integration provider, not on GATE’s own servers. GATE stores only a reference to the connection. Slack, GitHub, Meta Ads and WhatsApp credentials are the exception: we store those ourselves, encrypted. When you disconnect a service, its token is revoked at Composio.
Transfer mechanism
For subprocessors outside the EU we rely on the European Commission’s Standard Contractual Clauses (SCCs, Decision 2021/914), and, where the subprocessor offers them, additional technical safeguards like encryption in transit and at rest. The exceptions are z.ai and Moonshot (Kimi), which offer no transfer mechanism, and Higgsfield, which offers a data processing agreement and Standard Contractual Clauses only under an enterprise agreement that GATE does not have yet. They are used only when your organization turns them on.
Changes to this list
On Stable we give 30 days notice before we add a new subprocessor. On Edge, the rapidly iterating track an organization runs on until it moves to Stable, notice comes on the day of the change, before it takes effect. Notice goes out by email to the account address on file and is also posted at gate.software/legal/subprocessors. You can object within 30 days of the notice on reasonable data protection grounds; on Edge we then stop using the new subprocessor for your organization or move you to Stable, and if we can do neither you can close your account and we refund any unused prepaid balance (DPA section 4.4).
On Stable we may make changes faster than 30 days only in two situations: a security emergency where swapping providers protects user data, or a legal obligation that forces a change. In those cases we notify users as soon as we can.
Contact
Gate Intelligence AB Ankargränd 2, 111 29 Stockholm, Sweden legal@gate.software