Trust center
Security and compliance at Gleap.
Gleap is SOC 2 Type II audited and GDPR (DSGVO) compliant, with EU or US data residency chosen at signup. Everything you need to assess Gleap as a vendor is on this page.
Compliance at a glance.
What a security review asks first.
SOC 2 Type II Independently audited for the Security trust services category. The report specifies the systems and period covered. The report is shared with Pro and Enterprise customers: request it by emailing privacy@gleap.ai.
GDPR (DSGVO) GDPR-compliant processing with a public Data Processing Addendum, international-transfer safeguards for third-country transfers, and a documented sub-processor list.
EU and US data residency Choose EU or US hosting at signup for your customer content. Review the residency scope and provider processing locations in our data residency guide.
DORA vendor readiness Vendor information for financial entities regulated under DORA: Register of Information data, Article 30 mapping, and due-diligence support.
Encryption & security controls Technical and organizational measures per Art. 32 GDPR: encryption, access controls, availability, resilience, and recoverability.
HIPAA and health data Gleap does not publish a standard HIPAA Business Associate Agreement. Our DPA allows health data only when expressly agreed in writing. Contact privacy@gleap.ai before processing protected health information.
Built for the EU AI Act.
One switch, Enforce EU AI Act, applies the AI Act's transparency rules to Kai across your organization.
Kai says it is an AI Every Kai reply is labelled as AI, in the widget, by email and on WhatsApp, Instagram, Messenger, Telegram and Slack, and every call starts with it. You can reword the notice, not remove it.
Marked for machines too Kai's emails carry an AI header, its messages carry an AI field in the API and webhooks, and anyone can check whether a message was written by Gleap's AI.
A person can take over Customers can ask for a person at any time. Kai hands the conversation over with the full context and tells the customer a person takes over. Kai never claims to be one.
Your team sets the limits For each action Kai acts alone, asks a teammate for an OK or never acts, with money limits you set.
Model duties stay with the providers The providers of the general-purpose models Kai runs on carry the duties the AI Act sets for those models.
A team trained on AI Everyone at Gleap who builds or supports Kai is trained on how AI works, its limits and its risks.
Documents and resources.
Everything a security or compliance review typically needs.
EU and US data residency Region selection, processing scope, international transfers and setup documentation. Security practices Infrastructure, encryption, access controls, incident response, and product privacy controls. Sub-processors The third parties that process data on Gleap's behalf, with locations and purposes. DORA information for financial entities Gleap's role as an ICT third-party service provider under Regulation (EU) 2022/2554. Privacy Policy How Gleap collects, processes, and protects personal data. Terms of Service Including our incorporated Data Processing Addendum. Data Processing Addendum (PDF) Our standard DPA with international-transfer provisions, technical and organizational measures, and the approved sub-processor annex. Imprint Legal entity information for Gleap GmbH. Status page Current service status and incident updates.