Trust center
Security and compliance at Gleap.
Gleap is SOC 2 Type II audited and GDPR (DSGVO) compliant, with EU or US data residency chosen at signup. Everything you need to assess Gleap as a vendor is on this page.
Compliance at a glance.
What a security review asks first.
SOC 2 Type II Independently audited for the Security trust services category. The report specifies the systems and period covered. The report is shared with Pro and Enterprise customers: request it by emailing privacy@gleap.ai.
GDPR (DSGVO) GDPR-compliant processing with a public Data Processing Addendum, international-transfer safeguards for third-country transfers, and a documented sub-processor list.
EU and US data residency Choose EU or US hosting at signup for your customer content. Review the residency scope and provider processing locations in our data residency guide.
DORA vendor readiness Vendor information for financial entities regulated under DORA: Register of Information data, Article 30 mapping, and due-diligence support.
Encryption & security controls Technical and organizational measures per Art. 32 GDPR: encryption, access controls, availability, resilience, and recoverability.
HIPAA and health data Gleap does not publish a standard HIPAA Business Associate Agreement. Our DPA allows health data only when expressly agreed in writing. Contact privacy@gleap.ai before processing protected health information.
Documents and resources.
Everything a security or compliance review typically needs.
EU and US data residency Region selection, processing scope, international transfers and setup documentation. Security practices Infrastructure, encryption, access controls, incident response, and product privacy controls. Sub-processors The third parties that process data on Gleap's behalf, with locations and purposes. DORA information for financial entities Gleap's role as an ICT third-party service provider under Regulation (EU) 2022/2554. Privacy Policy How Gleap collects, processes, and protects personal data. Terms of Service Including our incorporated Data Processing Addendum. Data Processing Addendum (PDF) Our standard DPA with international-transfer provisions, technical and organizational measures, and the approved sub-processor annex. Imprint Legal entity information for Gleap GmbH. Status page Current service status and incident updates.