Security — Gatana

Reporting a vulnerability or security concern

Please include enough detail for us to reproduce the issue: the affected endpoint or component, the steps you took, and what you observed. If you have a proof of concept, attach it.

We acknowledge every report within one business day. We prioritise security reports regardless of the size of the account they came from.

If you believe customer data has been exposed, say so in the subject line.

What we ask of researchers

Report the issue to us before disclosing it publicly, and give us reasonable time to fix it.
Do not test against production in ways that could affect other customers — no denial of service, no automated scanning at volume, no attempts to access data that is not yours.
Do not access, modify, or retain customer data. If you encounter customer data, stop and tell us.

Safe harbour

If you follow the guidance above and report in good faith, we will not pursue legal action against you, and we will treat your report as authorised testing. We will work with you on timing if you intend to publish.

We do not currently run a paid bug bounty programme.

How we protect customer data

Gatana stores credentials and acts on behalf of end-users through the MCP Gateway, so the platform is built around limiting what any single component — or any single person — can reach.

Per-customer encryption. Each tenant has its own AES-256-GCM data encryption key, wrapped by a key held in Google Cloud KMS. The plaintext key exists only in application memory for the duration of an operation and is never written to disk.
Encryption of all storage at rest. On top of the per-customer keys, every storage layer that holds customer data is encrypted: the disks of the production servers and the distributed storage volumes (LUKS2, AES-XTS), and the backups (AES-256).
Audited key access. Every encrypt and decrypt operation is logged by Google Cloud Audit Logs, which are held by Google and cannot be altered by us.
Data residency. Live data is stored in Germany. Encrypted backups are stored in France.
Restricted access. Access to production systems and customer data is limited to personnel with a documented business need, granted on a least-privilege basis, protected by multi-factor authentication, and reviewed quarterly.

Incident notification

If a security incident affects your data, we notify you without undue delay and within 72 hours of becoming aware of it, as set out in our Data Processing Agreement. Notification includes what happened, what data was involved, what we have done, and what — if anything — you need to do.

Documentation

Our Data Processing Agreement is published in full. It forms part of our Terms of Service and sets out how we process personal data on your behalf, which sub-processors we use, and our breach notification commitments.

A SOC 2 examination is currently in progress. The report will be available to customers under NDA once it is issued.