Security & compliance

We build for the auditor first.

Lobbies process some of the most regulated personal data in any organisation. MyGatePass treats every visitor record as sovereign, sensitive and revocable — by design, not by policy.

Talk to security → View certifications

Certifications

Certified globally. Compliant locally.

SOC 2 Type II

Audited annually for security, availability & confidentiality.

ISO 27001

Certified information security management system.

GDPR aligned

Data-subject rights, DPA, and EU representation.

UAE PDPL

Compliant with Federal Decree-Law No. 45 of 2021.

KSA PDPL

Aligned to Saudi Personal Data Protection Law.

Qatar PDPPL

Aligned to Qatar privacy & protection law.

How we protect data

Six guarantees, baked in.

Encrypted end to end

AES-256 at rest, TLS 1.3 in transit. Visitor PII is encrypted with per-tenant keys; nothing leaves the gate in the clear.

Minimal by default

We capture only what a verification needs, redact what we can, and auto-expire visitor records on a schedule you control.

Tamper-proof audit

Every decision is written to an append-only log with cryptographic signing. Export two years of entries in minutes.

Isolated tenants

Each facility and tenant is logically isolated. A tower’s data is never visible to its neighbours, even on shared infrastructure.

Revoke instantly

Suspend a pass, a host, or an entire tenant in one click. Revocations propagate to every gate in under a second.

Secure by API

HMAC-signed webhooks, scoped API keys, IP allow-lists and full SCIM provisioning for enterprise identity.

Data residency

Your data never leaves the UAE.

Storage, processing, backups and audit logs all live inside MOI-aligned UAE infrastructure. We run edge points of presence in Dubai, Abu Dhabi and Riyadh — so decisions are fast and data stays sovereign.

Primary region in the UAE, with in-region disaster recovery

Single-tenant sovereign residency available for Portfolio

No cross-border replication without explicit consent

Sub-processor list published and version-controlled

DXB

AUH

RUH

Transparency

Sub-processors, in the open.

Category	Provider	Region	Purpose
Cloud infrastructure	Regional hyperscaler	UAE	Hosting & compute
Identity verification	UAE Pass	UAE	National identity match
Messaging	Regional SMS / WhatsApp BSP	UAE	Pass dispatch
Email	Transactional email provider	EU / UAE	Notifications
Observability	Logging & monitoring	UAE	Operational telemetry

Responsible disclosure

Found a vulnerability? We run a coordinated disclosure programme and respond to all reports within 24 hours. Security researchers are recognised in our hall of fame and eligible for bounties.

security@mygatepass.com

Get started

Turn every arrival into a verified moment.

Pilot MyGatePass on one gate. We’re on-site within 5 business days anywhere in the UAE — and online for the rest of the GCC.

Request a demo → Talk to sales