Login
Start free trial

DORA

Information for financial entities

The EU Digital Operational Resilience Act (DORA, Regulation (EU) 2022/2554) applies to financial entities such as banks, insurers, payment institutions, and investment firms. If your organization is regulated under DORA, this page provides the vendor information you need for your ICT third-party risk management: your due diligence, contractual arrangements under Article 30, and your Register of Information.

Gleap’s role under DORA

  • Gleap is an ICT third-party service provider within the meaning of DORA. DORA does not regulate Gleap directly; it reaches us through the requirements it places on our regulated customers.
  • Gleap is not designated as a critical ICT third-party provider (CTPP) by the European Supervisory Authorities and is therefore not subject to direct EU oversight.
  • There is no official DORA certification for ICT providers. Gleap supports its regulated customers’ own DORA compliance with information, contractual commitments and cooperation. Whether your use of Gleap supports a critical or important function is your organization’s assessment; most customers use Gleap for customer support and product feedback, which they typically do not classify as such.

Vendor datasheet for your Register of Information

  • Legal name: Gleap GmbH
  • Registered address: Am Dorfplatz 3, 6858 Schwarzach, Austria
  • Company register: FN 534390 v, Regional Court Feldkirch (Austria)
  • VAT number: ATU 75671417
  • LEI: 984500FHA581037A0R84 (view on GLEIF)
  • Type of ICT service: S19, Cloud computing services: Software as a Service (SaaS), per the ESAs’ taxonomy (Annex III of the ITS on the Register of Information)
  • Service description: Customer support, feedback, and bug reporting platform (AI-assisted customer service suite)
  • Data processing & storage locations: EU or US data residency, chosen at signup; residency scope and provider breakdown on the sub-processors page
  • Governing law: Austrian law (per our DPA)

Article 30: how Gleap supports the required contractual provisions

Our Terms of Service and Data Processing Addendum address several Article 30(2) elements. The list below shows where. Enterprise agreements can add entity-specific terms.

  • Service and function description: documented in the Terms of Service and the DPA (subject matter of processing, DPA clause 2).
  • Data locations and change notification: processing and storage locations are documented per sub-processor in Annex 8.10 of the DPA. Before a new or replacement sub-processor engaged directly by Gleap starts processing your personal data, Gleap sends at least 30 calendar days’ advance email notice naming the provider, processing activities, locations, start date and transfer safeguards (DPA clause 8.1).
  • Protection of data: availability, integrity, and confidentiality commitments via the DPA’s technical and organizational measures (Annex 6.1); see security practices.
  • Sub-outsourcing: you grant general written authorization for the sub-processors listed in Annex 8.10. You can object to a new sub-processor on reasonable data protection grounds during the notice period, and it does not process your personal data while a timely objection is unresolved. If an objection cannot be resolved within 30 days, either party may terminate the affected service (DPA clause 8.1). When a sub-processor changes its own processors, Gleap forwards the notice by email promptly, with the upstream notice and objection periods, which can be shorter than 30 days (DPA clause 8.4). Gleap reviews sub-processor compliance on a risk-based basis and at least annually (DPA clause 8.8). The sub-processors page lists providers, locations and purposes.
  • Incident assistance and notification: Gleap notifies you of a personal data breach without undue delay after becoming aware of it and can provide information in phases (DPA clause 9.1). Material failures to comply with the DPA that affect your personal data are also notified without undue delay (DPA clause 9.2). Gleap supports your obligations under Articles 33 and 34 GDPR to the extent necessary (DPA clause 9.4).
  • Cooperation with competent authorities: to the extent legally permitted, Gleap informs you without undue delay of supervisory inspections or legally binding measures that materially relate to your personal data (DPA clause 9.3). If you are subject to an inspection, Gleap supports you to the extent the processing for you is affected (DPA clause 5.7).
  • Access, recovery, and return of data: after the end of services, you choose between return of your personal data, through the available export functionality or another reasonably agreed format, and deletion. Tell us within 30 days after termination; without a choice, the data is deleted (DPA clause 11.1). On reasonable request, Gleap confirms completion of deletion (DPA clause 11.3).
  • Termination and exit support: termination follows the Terms of Service; a cancelled subscription ends at the end of the current billing period. Bespoke export or migration work can be agreed in advance at reasonable rates (DPA clause 11.1).
  • Audit and information rights: Gleap makes available the information needed to demonstrate compliance with Article 28 GDPR and allows audits, including inspections, by you or an independent auditor you mandate. Routine assurance starts with independent audit reports, such as our SOC 2 Type II report, relevant documentation and written answers. If these do not resolve a substantiated concern, a scoped inspection is allowed. Routine audits need 30 days’ written notice, take place during business hours at most once per year and are at your expense. These limits do not apply where a competent authority requires otherwise, after a relevant personal data breach, or to investigate credible evidence of material non-compliance (DPA clause 6.8).

Incident notification

  • Personal data breaches: notification without undue delay after Gleap becomes aware, sent to the notification email you designate or, if none is current, your administrative account contact. Information can follow in phases as it becomes available (DPA clause 9.1).
  • Contact for incident and breach matters: privacy@gleap.ai (reaches Gleap’s data protection contact directly).
  • Real-time service status: status.gleap.io.

Due diligence & requests

For your vendor assessment we provide via privacy@gleap.ai:

  • The current SOC 2 Type II report (under NDA, for Pro and Enterprise customers).
  • Completed DORA / security questionnaires.
  • A signed DPA, and discussion of DORA-specific contractual addenda for ICT services supporting critical or important functions (enhanced SLAs, resilience testing cooperation, extended audit rights including pooled audits, exit strategies) as part of an Enterprise agreement.