Privacy Policy

Controller: Gated. Contact: privacy@gated.cc.

• Account data. Name, email, organization, and authentication details, managed through our auth provider (Clerk).
• Scan data. The targets you submit, scan configurations, results, findings, and operational logs generated when a scan runs.
• Usage and technical data. Standard logs — IP address, browser, timestamps, and product interactions — used to operate and secure the service.
• Billing data. Handled by our payment processor. We do not store full card numbers.

We use your data to:

• Provide the scanning service and deliver results to you.
• Operate, secure, monitor, and debug the service.
• Improve Gated — including its checks, detection accuracy, and remediation guidance. This means we process scan results, findings, and logs to make the product better.
• Communicate with you about your account, scans, and service changes.
• Meet legal and compliance obligations.

We do not sell your personal data.

We process data to perform our contract with you, for our legitimate interests in operating and improving the service, to comply with legal obligations, and — where required — with your consent.

We share data only with subprocessors that help us run Gated, each under contract and only as needed. We may disclose data if required by law. We do not share identifiable scan data with advertisers or data brokers.

The current list of subprocessors used to operate Gated:

• Amazon Web Services. Hosting, storage, networking, KMS-managed encryption keys, and Bedrock-hosted models used by adversarial scans.
• Clerk. User authentication, organization, and membership management.
• Cloudflare. Edge network, DNS, and proxying of analytics traffic.
• PostHog. Product analytics and usage telemetry.
• Sentry. Application error monitoring and crash reporting.
• Stripe. Subscription billing and payment processing.

Material changes to this list are posted here. Questions: privacy@gated.cc.

We retain account and scan data for as long as your account is active, and afterward as needed to meet legal, security, and operational requirements. You can request deletion as described below.

Data is encrypted in transit and at rest. Target credentials get an additional layer of envelope encryption with per-organization AWS KMS keys, decryptable only by the scan worker. Infrastructure runs on private subnets. See the Security page for detail.

Depending on your jurisdiction, you can request to access, correct, export, or delete your data, object to or restrict certain processing, and withdraw consent. To exercise these rights, email privacy@gated.cc. Under the LGPD you may also contact the ANPD; under the GDPR, your local supervisory authority.

Gated is hosted in the United States. If you access it from elsewhere, your data is transferred and processed in the US under appropriate safeguards.

We’ll update this page when our practices change and revise the date above. Material changes will be communicated to account holders.

Questions: privacy@gated.cc.