GATE Trust Center
The security, privacy, and AI-governance controls that back our alignment with ISO/IEC 42001, AICPA SOC 2, and GDPR.
This page lists the controls GATE runs today. They map to the AICPA SOC 2 trust services criteria, the ISO/IEC 42001 AI management standard, and GDPR. We keep it concrete: what we actually do, not what we intend to do.
Security
Encryption, sign-in, access control and audit logging are set out on our Security Overview.
Availability
Hosting, backups and monitoring are set out on our Security Overview.
Confidentiality
Isolation between customers, and who can read your content on Edge, on Stable and on a dedicated server, are set out on our Security Overview.
Processing integrity
- Change management. All code changes go through version control, pull requests, and review before they reach production.
- Cost and usage accounting is tracked per organization and per provider.
Privacy (GDPR)
- Data controller: Gate Intelligence AB, Sweden.
- Lawful bases, retention, and your rights are set out in our Privacy Policy.
- Data minimization. We collect only what the service needs.
- Deletion and export. Delete your account yourself under Settings > Account: your connected accounts are revoked at their providers, and the deletion is confirmed to you by email. For a copy of your data, email legal@gate.software. Section 7 of our Privacy Policy says what happens.
- International transfers are covered by the EU Standard Contractual Clauses, except to the providers in China, which offer none, and Higgsfield, which offers them only under an enterprise agreement GATE does not have yet. All three are off unless your organization turns them on. A full subprocessor list is published.
AI management (ISO/IEC 42001)
- Model governance. We choose the model per task. Section 4 of our Privacy Policy lists every model provider, and which ones stay off unless your organization turns them on.
- Human oversight. A human stays in the loop where judgement matters; high-impact actions can require explicit approval.
- Transparency. Every tool call your agents make shows in the chat, and your organization’s owner can open an access log.
- Training on your data. GATE does not use your content to train machine learning models. A sub-processor that GATE classifies as training on data it receives is used only after your organization’s owner explicitly turns on “Allow providers that may train on your data”; it is off by default. Our Data Processing Agreement names each one, and names the two whose terms allow training by default where this opt-in does not yet apply.
How data moves and the legal basis for each transfer
Where each piece of data is processed, and the legal mechanism we rely on. EU/EES processing needs no transfer mechanism. For the US we rely on the EU Standard Contractual Clauses (SCCs, 2021/914), and additionally the EU-US Data Privacy Framework (DPF) where the provider is certified.
| What | Where it is processed | Leaves the EU? | Legal basis |
|---|---|---|---|
| Hosting, database, file storage | EU (Germany and Finland) | No | None needed, EU |
| Payments | EU (Ireland) | No | None needed, EU |
| Everyday chat | US | Yes | SCCs, plus DPF where certified |
| Building / code sessions | US | Yes | SCCs, plus DPF where certified |
| Chat fallback and Kimi models, only if your organization turns on providers in China | China | Only when turned on | No SCCs: their terms offer none (DPA, Annex 2) |
| Transcription, meeting speech, images and video | US | Yes | SCCs, plus DPF where certified |
| Reply quality checks | US | Yes | SCCs, plus DPF where certified |
| Integration OAuth tokens | US | Yes | SCCs, plus DPF where certified |
| DNS, CDN, edge security | US | Yes | SCCs, plus DPF where certified |
| Transactional email | US | Yes | SCCs, plus DPF where certified |
| Voice (only if you use it) | US | Yes | SCCs |
To keep everything in the EU: we scope a local EU package with you, with AI, email, data and hosting on EU-based providers. Until that is agreed and set up, your organization uses the default setup above.
Subprocessors
Every company we rely on to deliver GATE is listed, with its location and when it is used, on our Subprocessors page. On Stable we give 30 days notice before adding a new one; on Edge, the rapidly iterating track an organization runs on until it moves to Stable, notice comes on the day of the change, before it takes effect (DPA section 4.4).
Incident response
If a personal-data breach meets the GDPR threshold, we notify the Swedish authority (IMY) within 72 hours and affected customers without undue delay. Business customers under our DPA are notified within 48 hours of GATE becoming aware of a breach affecting their data.
Questions
Our Data Processing Agreement is published. For a signed copy, a control map, or anything else, email legal@gate.software.