Trust & Security Center
Security is our
foundation
If we're asking you to trust us with your security posture, we'd better have ours in order. Here's how we do it.
Verified security
Certifications & Compliance
Where we stand today with third-party verification.
SOC 2 Type II
PursuingCurrently pursuing annual audit by independent third party to verify our security controls.
GDPR
CompliantFull compliance with EU General Data Protection Regulation requirements.
ISO 27001
PursuingCurrently pursuing information security management system certification.
EU AI Act
ReadyPrepared for upcoming EU AI regulation requirements.
How we protect you
Security Architecture
How PureGate keeps your data safe at every layer.
Local-First Architecture
All data scanning and masking happens on the user's device. Sensitive data never leaves your network for analysis. This means zero latency and maximum privacy.
End-to-End Encryption
All data in transit is encrypted using TLS 1.3. Data at rest is encrypted using AES-256. Encryption keys are managed using industry-standard key management practices.
Zero Trust Model
We follow zero trust principles: verify explicitly, use least privilege access, and assume breach. Every request is authenticated and authorized.
Data Minimization
We only collect the minimum data necessary to provide our service. Logs are anonymized and retained only as long as required for your compliance needs.
Comprehensive detection
Data Types We Detect & Mask
PureGate automatically detects and masks these sensitive data types before they reach AI tools.
Need custom detection patterns? Contact us for enterprise solutions.
Our practices
Security Practices
What we do day-to-day to keep the platform secure.
Infrastructure
- Hosted on EU-based data centers (AWS eu-west-1)
- Regular penetration testing by third parties
- 24/7 infrastructure monitoring and alerting
- Automated vulnerability scanning
- DDoS protection and rate limiting
Access Control
- Role-based access control (RBAC)
- Multi-factor authentication required
- Single Sign-On (SSO) support
- Audit logging of all admin actions
- Automatic session timeout
Development
- Secure Software Development Lifecycle (SSDLC)
- Code review required for all changes
- Automated security testing in CI/CD
- Dependency vulnerability scanning
- Regular security training for engineers
Incident Response
- 24/7 security incident response team
- Documented incident response procedures
- Customer notification within 72 hours
- Post-incident analysis and reporting
- Regular incident response drills
Legal documentation
Data Processing Agreement
We provide a comprehensive Data Processing Agreement (DPA) that covers GDPR requirements and clearly defines how we handle your data. Available for all customers upon request.
- GDPR-compliant data processing terms
- Standard contractual clauses included
- Sub-processor transparency
- Data deletion and portability rights
Responsible Disclosure
Found a security vulnerability? We appreciate responsible disclosure and will work with you to address any issues.
[email protected]Questions?
Questions about security?
Need our SOC 2 report, a DPA, or answers for your procurement team? We'll get you what you need.