Login
Start 14-day free trial
Trust center

Security and compliance at Gleap

SOC 2 Type II audited. GDPR (DSGVO) compliant. EU and US data residency. Everything you need to assess Gleap as a vendor, in one place.
Compliance at a glance
SOC 2 Type II
Independently audited for the Security trust services category. The report specifies the systems and period covered. Request the current report by emailing privacy@gleap.io.
GDPR (DSGVO)
GDPR-compliant processing with a public Data Processing Addendum, international-transfer safeguards for third-country transfers, and a documented sub-processor list.
EU and US data residency
Choose EU or US hosting at signup for your customer content. Review the residency scope and provider processing locations in our data residency guide.
DORA vendor readiness
Vendor information for financial entities regulated under DORA: Register of Information data, Article 30 mapping, and due-diligence support.
Encryption & security controls
Technical and organizational measures per Art. 32 GDPR: encryption, access controls, availability, resilience, and recoverability.
HIPAA BAA
A Business Associate Agreement is available on the Enterprise plan for customers subject to HIPAA.

Documents & resources

Everything a security or compliance review typically needs:

SOC 2 Type II report: available under NDA on request. Email privacy@gleap.io and we’ll share the current report.

Trust FAQ
How do I get Gleap's SOC 2 Type II report?
Email privacy@gleap.io. We share the current SOC 2 Type II report under NDA with customers and qualified prospects.
Where is my data hosted?
Choose EU or US data residency when you sign up. Customer content is hosted in the selected region. AI, email, integrations and other providers may process data outside that region. See our data residency guide and sub-processors page.
Is Gleap DORA compliant?
DORA regulates financial entities, not their software vendors, and no DORA certification exists for providers. Gleap is DORA-ready as an ICT third-party service provider: we supply the contractual terms, Register of Information data, incident notification, and exit support our regulated customers need for their own compliance. Details on the DORA page.
Do you sign DPAs?
Our DPA is incorporated into our Terms of Service, so no signature is required. If your organization needs a copy signed by both parties, email privacy@gleap.io. To keep terms consistent we sign our standard DPA rather than customer-provided DPAs.
Can the AI features be disabled?
Yes. AI features are optional, and the AI providers listed on the sub-processors page only process data when AI features are actively used. They can be fully disabled; contact us for details.
How do I report a security issue?
Email privacy@gleap.io. Reports go directly to the team responsible for security and data protection at Gleap.