Cryptographic integrity. Zero ID leakage.
GateZ is engineered so that privacy and security are enforced by code and mathematics—not just policies. Here is exactly how our systems protect your organization's physical and digital perimeter.
Append-Only, Hash-Chained Audit Logs.
Every visitor check-in, host approval, gate override, and lockdown is sealed into a cryptographic SHA-256 chain. Test the interactive simulation below to see how retroactive tampering is mathematically impossible to conceal.
Tamper-Evident SHA-256 Ledger
CHAIN INTACT & CRYPTOGRAPHICALLY SEALEDAppend-only row-level security. Every event sealed with parent block hash.
| Block | Timestamp | Event & Actor | Subject / Details | Previous Hash | Current Hash | Verification |
|---|---|---|---|---|---|---|
| #107 | Today · 09:28:14 IST | HOST_APPROVED_ENTRYArvind R. (UID #4092) | Vikram Malhotra · KPMGGate 02 (North) | 0a78f219...bc81 | 3f92d841...77e9 | VERIFIED |
| #108 | Today · 09:31:02 IST | CAB_AUTO_ADMITStanding Rule #14 | Uber Premier · DL 01 ···· 8842Gate 01 (Main) | 3f92d841...77e9 | 8c10fa92...55b4 | VERIFIED |
| #109 | Today · 09:34:40 IST | MATERIAL_DISPATCH_CLOSEDSupervisor Sharma (Pass #M-89) | Server Rack Components (Qty: 4)Gate 03 (Loading) | 8c10fa92...55b4 | e199d701...99a0 | VERIFIED |
9 Built-In Security Guarantees.
Capabilities built and verified in the GateZ core today.
Personal Data Encrypted at Rest
Mobile numbers, visitor photographs, and personal details are sealed with AES-256-GCM. Lookups use keyed cryptographic hashes, never plain numbers in SQL queries.
Last 4 Characters of ID Only
The gate terminal records which ID type was shown (e.g. DL, Voter ID) and its last 4 characters only. Full Aadhaar or passport storage is systematically refused by our schema.
Row-Level Database Isolation
PostgreSQL database row-level security (RLS). One organisation's visitors, personnel, and registers are completely invisible to any other tenant, even if a query omits its filter.
Strong Sign-in Protections
Authenticator-app 2FA with recovery codes, one-time email tokens, session verification on every request, idle sign-out, "sign out everywhere", and aggressive rate limiting on gate actions.
Step-Up Reconfirmation
Sensitive operations—site lockdowns, custom domain branding changes, role elevation, and API key provisioning—require password re-entry and a documented business reason.
Consent & Privacy Rights (DSAR)
Visitors see clear privacy notices and consent at check-in. Automated data retention schedules and 1-click Data Subject Access Requests (DSAR export/deletion) are built into the admin console.
Safe 10-Minute Links
One-tap visitor approval links work once, for one specific person, and expire automatically after 10 minutes. Links cannot be replayed or shared.
Signed HMAC Webhooks
Every outbound webhook payload is cryptographically signed using HMAC-SHA256 headers. API keys are stored hashed and scoped strictly to a single tenant organisation.
Offline Integrity Synchronization
When mobile data drops at the gate, records queue locally in indexed offline storage with tamper-check signatures, synchronizing cleanly with zero duplicate entries upon reconnection.
Our Policy on Security Certifications
In accordance with our strict product integrity guidelines, GateZ does not make unverified claims. We do not claim ISO 27001 or SOC 2 certification, third-party penetration test attestations, or an uptime SLA until independent audits have been formally completed and published.
What we do guarantee is transparent code, cryptographic data isolation, AES-256-GCM encryption at rest, and an append-only audit trail that mathematically verifies itself on every gate action.