Compliance

TrustGate's flagship compliance posture: no PII at the edge. That's the architectural promise the entire compliance story flows from.

GDPR — minimal data-minimisation footprint

Because credentials pass through the door device but are never stored there, TrustGate's GDPR surface area is minimal. The door is not a data controller for the presented credentials; it's a verifier proxy. The operator (you) is the controller, and your audit log is anonymous-by-design.

• Data minimisation (Art. 5(1)(c)) — nothing stored at the edge
• Storage limitation (Art. 5(1)(e)) — operator-controlled access-log retention
• International transfers (Art. 44) — no PII transits TrustGate infrastructure

NIS2 — access control

TrustGate directly supports the NIS2 access-control posture (Annex II §1). Credential-gated entry means only credential-holders with valid attributes enter — revocations propagate instantly via Broker's trust-chain checks. Incident handling: access-log anomalies (unusual DENY rates, off-hours attempts) feed the customer's incident-response flow.

DORA

For financial-services customers, TrustGate is a documented third-party ICT component for physical-access control. Operational-resilience testing includes door-device connectivity, Broker availability, and fallback behaviour when the verification path degrades.

Physical-security certification

TrustGate is the decision surface; certification of the physical enclosure (IP rating, tamper evidence, physical-attack resistance) is the integrator's responsibility. The software API is designed to integrate with certified hardware.