In transit
Encrypted in transit (TLS). HTTPS is enforced on every endpoint. No plaintext communication is permitted.
Gateplex is deployed inside regulated institutions. This page states how data is protected, where it lives, and what our compliance posture actually is today.
Encrypted in transit (TLS). HTTPS is enforced on every endpoint. No plaintext communication is permitted.
Encrypted in transit (TLS) and at rest (AES-256, provided by our database provider).
Row-level security is enforced at the database layer. Every query is scoped to the authenticated organisation, so cross-tenant access is not possible.
API keys are scoped to a project, visible only to the organisation's administrators, and are never written to logs.
EU, US, UK, or GCC and MENA residency on Enterprise plans. Data does not leave the configured region.
Every intercept record stores a SHA-256 hash of its own content together with the hash of the record immediately preceding it.
Chain integrity is verified when a compliance report is generated. Deleting or modifying any record breaks the chain, and the break is detectable. This is what separates an audit trail from an application log.
| Programme | Status | Detail |
|---|---|---|
| SOC 2 Type I | [Planned] | SOC 2 Type I is planned and has not started. We hold no compliance certification today and claim none. |
| GDPR | [Processor role] | We act as a data processor for customer data. Data subject access request workflows are supported and a DPA is available on request. |
| EU AI Act | [Mapped to Articles 12, 14, and 50] | Record-keeping, human oversight, and transparency obligations are mapped to product capabilities, with exports formatted for regulatory review. |
Dashboard permissions are role scoped. Approval decisions are restricted to authorised reviewers and recorded against a server-derived identity.
Single sign-on is planned.
Responsible disclosure at security@gateplex.ai. Valid reports are acknowledged within 48 hours, under a 90-day disclosure policy.
In VPC and air-gapped deployments, evaluation is designed to run inside the customer's environment.