Privacy Policy
This policy explains how Gatehouse ("Gatehouse", "we", "us") handles personal data on usegatehouse.com and in the Gatehouse service we host. If your company runs Gatehouse on its own servers (self-hosted), that company controls the data and its own privacy policy applies. We don't receive data from self-hosted installations.
#Summary
- We collect what we need to run Gatehouse: your account details, your organization's configuration, and records of what AI agents did through it.
- We don't sell personal data, and we don't use it for advertising.
- The website uses no analytics or tracking cookies. The only cookies are the ones that keep you signed in.
- Credentials you give Gatehouse for your systems are encrypted and are never shown to AI agents or to our staff.
#Who is responsible
For the hosted service, your organization is the controller of the data it puts into Gatehouse, and we act as its processor. We process it only on your organization's instructions, as described in our Terms and any data processing agreement we sign with you.
For the website and for sales and support communication, we are the controller.
#What we collect
| Data | Examples | Why |
|---|---|---|
| Account details | Name, work email, role, groups, sign-in method | To let you sign in and to apply your organization's policies |
| Sign-in and security data | Hashed passwords, two-step verification settings, session and device details, IP addresses | To keep accounts secure and detect abuse |
| Organization configuration | MCP servers, policies, groups, approval settings, SSO and SCIM settings | To provide the service |
| Credentials for your systems | API tokens and keys for the MCP servers you connect | To call those systems on your behalf. Stored encrypted with AES-256-GCM |
| Audit records | Which agent called which tool, when, the decision, and arguments with secrets removed | Your organization's audit trail, which is the core of the product |
| Support and sales communication | Emails and messages you send us | To answer you |
We don't need, and ask you not to put, special categories of personal data (such as health data) into Gatehouse.
#How long we keep it
- Account and configuration data: while your organization uses Gatehouse, then deleted within 30 days of the end of the agreement, unless the law requires us to keep it.
- Audit records: for the retention period your plan includes, or as your organization configures.
- Encrypted backups: up to 30 days, then deleted automatically.
#Where it is stored
The hosted service runs on Amazon Web Services in the United States (us-east-1). Backups are encrypted before they leave the server. See Subprocessors for the companies that help us run the service.
When personal data from the EU, UK or Switzerland is transferred to the United States, we rely on the European Commission's Standard Contractual Clauses (and the UK addendum) or another lawful transfer mechanism.
#Security
Gatehouse is built to sit in front of sensitive systems, and we apply the same standards to our own service: encryption in transit and at rest, single sign-on and two-step verification, least-privilege access, a tamper-evident audit log, and encrypted off-site backups. Read more on our security page.
#Your rights
Depending on where you live, you can ask to access, correct, delete or export your personal data, object to or restrict processing, and complain to a data protection authority.
If your organization's Gatehouse holds your data, please contact your organization's administrator first, because they control it. We will help them respond.
For anything else, email privacy@usegatehouse.com. We answer within 30 days.
#Cookies
| Cookie | Purpose | Lifetime |
|---|---|---|
gatehouse_session |
Keeps you signed in to the console | Until you sign out, or your organization's session limit |
gatehouse_mfa |
Holds a sign-in in progress while you enter a verification code | 10 minutes |
gatehouse_sso |
Ties a single sign-on attempt to your browser, to prevent login forgery | 10 minutes |
We don't use analytics, advertising or third-party cookies.
#Changes
If we make material changes, we'll update the date above and notify account owners by email before the changes take effect.
#Contact
Privacy questions: privacy@usegatehouse.com. Security issues: see Report a vulnerability.