Trust Center
Everything you need to evaluate gtwy's security.
Certified controls, a public subprocessor list, and the legal paperwork your team needs, without waiting on an email thread.
Certifications & frameworks
SOC 2 (Type II)
Independent audit of security, availability, and confidentiality controls across the platform.
Full report — available on request
ISO 27001
Information security management system covering infrastructure, access control, and incident response.
Certificate — available on request
GDPR & CCPA
Data processing terms, subprocessor disclosure, and deletion workflows are set out in the Data Processing Addendum.
DPA — available on request
Subprocessors
22 vendors| Vendor | Category | Purpose | Region |
|---|---|---|---|
| OpenAI | AI provider | Chat completion, embeddings, image generation | Global |
| Anthropic | AI provider | Chat completion & batch inference | Global |
| Google Gemini | AI provider | Chat completion & multimodal inference | Global |
| Groq | AI provider | Low-latency inference routing | Global |
| Grok (xAI) | AI provider | Chat completion | Global |
| Mistral AI | AI provider | Chat completion | Global |
| Deepgram | AI provider | Speech-to-text transcription | Global |
| OpenRouter | AI aggregator | Routes to additional third-party models | Global |
| NeevCloud | AI provider | GPU inference hosting | Global |
| Moonshot AI | AI provider | Chat completion | Global |
| DeepSeek | AI provider | Chat completion, reasoning | Global |
| MiniMax | AI provider | Chat completion, reasoning | Global |
| NotDiamond | Routing | Automatic model routing across providers | Global |
| Google Cloud Platform | Infrastructure | Primary hosting & compute | Self-hosted (GCP) |
| Cloudflare | Infrastructure | CDN / network layer | Global (edge network) |
| MongoDB | Data store | Primary application database | Self-hosted (GCP) |
| PostgreSQL / TimescaleDB | Data store | Metrics & time-series storage | Self-hosted (GCP) |
| Redis | Data store | Caching & session state | Self-hosted (GCP) |
| RabbitMQ | Infrastructure | Async job & message queueing | Self-hosted (GCP) |
| PostHog | Analytics | Product usage analytics | Global |
| RTLayer | Real-time | Live event & notification delivery | Global |
| Cal.com | Scheduling | Demo & sales meeting booking | Global |
Legal & policies
FAQ
Do you sign custom DPAs?+
Our standard DPA covers most cases, and can include Standard Contractual Clauses for international transfers where applicable. Redlines go through legal review on request.
Where is customer data hosted?+
gtwy's infrastructure is self-hosted on Google Cloud Platform in a single region, located in India. See the subprocessor list above for every third party in the data path.
How do I get the full SOC 2 report?+
The certification summary is public on this page. The full audit report is shared under NDA — email [email protected] and our security team will respond within 24 hours.
What happens to our data if we leave?+
Data export and deletion timelines on account closure are set out in the Terms of Service.
Need the full report?
SOC 2 report and signed DPA, sent to your work email.