{"id":1332,"date":"2021-10-23T23:56:00","date_gmt":"2021-10-23T23:56:00","guid":{"rendered":"https:\/\/gatlabs.com\/education\/?page_id=1332"},"modified":"2025-10-06T13:41:05","modified_gmt":"2025-10-06T13:41:05","slug":"third-party-risk-assessment","status":"publish","type":"page","link":"https:\/\/gatlabs.com\/education\/third-party-risk-assessment\/","title":{"rendered":"Third Party Risk Assessment"},"content":{"rendered":"\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Third Party Risk Assessment<\/h1>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t\t
\n\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

POLICY AND STANDARDS<\/h3>

1. Is your company UK or EU based (i.e. all servers\/ staff sit within the EU and are therefore under EU GDPR legislation).<\/strong><\/p>

We operate a distributed platform where customers can choose their data storage location.<\/div>
Our default location is US, but any customer can choose their data to be stored either in the EU, UK or US. Data stored in the EU is subject to GDPR, data stored in the UK is subject to UK data protection rules.<\/div>
\u00a0<\/div>

2. Do you have an ISO27001 certification or another form of information security accreditation (e.g. A GDPR compliant certificate, PCI DSS, ISO22301\/BS2599, COBIT)?<\/b><\/p>

Yes, GAT Labs is certified SOC II compliant (you may request access to our SOC II report here<\/a>).\u00a0<\/p>

In addition the service is run on GCP (Google Cloud Platform) in North America. This facility completed multiple SAS70 Type II audits, and now publishes a Service Organization Controls (SOC 1, 2 and 3) report, published under both the SSAE 16 and the ISAE 3402 professional standards. In addition, GCP has achieved ISO 27001 certification and has been successfully validated as a Level 1 service provider under the Payment Card Industry (PCI) Data Security Standard (DSS), HIPAA and more.<\/span><\/p>

3. Do you have written information security, data protection and confidentiality policies that outline your overall policy framework?<\/strong><\/p>

Yes, see our security policy statement<\/p>

DATA PROTECTION AND PRIVACY<\/span><\/h3>

4. Do you have a DPO in place?<\/strong><\/p>

Yes, dpo@generalaudittool.com<\/p>

5. Do you maintain a record of your data processing activities in line with the requirements of the General Data Protection Regulation including DPO details; Processing purpose; Data types; Sharing details; International transfers; Retention periods?<\/strong><\/p>

Yes.<\/p>

6.\u00a0<\/strong>Will you need to\/ be required to access personal data\/ confidential information belonging to our organization? e.g. staff; customer data; confidential business information.<\/b><\/span><\/p>

Yes, However GAT Labs only requires metadata (name, email address, email headers, file shares, etc.). We build our exposure profile based purely on the metadata. GAT never retrieves file contents for auditing. We believe the risk in extracting file contents from the secure \u2018shredded\u2019 environment of Google\u2019s servers to any third party software is too great for companies serious about security, so we don\u2019t do it. Some of the most security-sensitive government customers in the US and the UK use GAT precisely because we don\u2019t extract file contents.<\/span><\/p>

INFORMATION SECURITY AND RISK MANAGEMENT<\/h3>

7. Do you have a policy and process for secure disposal of both IT equipment and media?<\/strong><\/p>

No customer data is ever stored on local equipment or media. Google is responsible for this.<\/p>

8. Will our organisation be able to manage who has access to the service (our organization\u00b4s staff)?<\/strong><\/p>

GAT is the very first Google Workspace security tool provider to offer \u2018lock and key\u2019 access to Google Workspace files and emails. Ever aware that end-user security is paramount, this feature set goes much further than any of our competitors, not only does it allow for full file management, but it is the only tool to give silent views of all files and emails (Admins and Security Officers won\u2019t appear as \u2018Viewers\u2019 of the files or emails), while at the same time it executes in a secure way that deeply protects end user\u2019s rights. We carefully designed the solution to require both a lock and key for access. Managers, C level executives and security officers can also relax knowing you cannot download GAT and have unrestricted access to sensitive financial files or snoop on HR emails. Google Workspace Admin staff using GAT can report that they have the most functional security tool in the marketplace, yet with the highest security standards available.<\/p>

9. Do you have an encryption policy which covers data encryption in transit and at rest?<\/strong><\/p>

\u201cThe Tool itself runs using a 2048-bit modulus RSA key, SHA256 used for hashing, AES (256-bit) used for encryption. It is Verified by Comodo. This ensures the site you connect to is who it says it is (generalaudittool.com), thus eliminating man in the middle attacks. It also ensures that any data transferred is moved inside an HTTPS tunnel, from Google to the audit tool and from the audit tool to your browser.<\/p>

10. Do you undertake security testing and audits such as penetration testing and internal and external vulnerability scanning?<\/strong><\/p>

Yes, We have extensive pen testing of all our products (reports available to prospective customers). In addition, because we use GCP as both our processing and storage platform, our data management environment is also subject to pen testing and protection processes put in place by Google.<\/p>

INCIDENT MANAGEMENT<\/h3>

11. Do you have a Security\/ Breach Incident Management Policy and Procedure in place?<\/strong><\/p>

In the event of a customer data breach, we have a declared policy of customer notification. The response to any specific incident will depend on the nature of the incident and is not defined in specific terms.<\/p>

12. Do you have a Business Continuity Policy in place?<\/strong><\/p>

For business continuity of our cloud services, we are dependent on GCP business continuity.<\/p>

13. Do you have a Privacy policy? As an EU based company, this would comply with GDPR requirements.<\/strong><\/p>

Our privacy policy is stated as complete non-disclosure of customer data and automatically implemented \u2018right to be forgotten\u2019 of customer data after 30 days since last use. This policy predates GDPR. There is no access to customer data by any staff other than development engineers. Customer data is never removed from GCP.<\/p>

14. You are based in Ireland, and run services on the North American GCP. Could you please confirm your view as to whether this means that data transfers outside of the EU?<\/strong><\/p>

Yes, we are based in Ireland. We state so clearly on our website. Yes, our services are run 100% from GCP in North America. It is our view that data is transferred out of the EU and its protection is covered by Google under the EU\/US data protection umbrella agreement. We as a data processor are covered directly by EU law.<\/p>

METADATA MANAGEMENT<\/h3>

15.\u00a0 What data do we work with?<\/strong><\/p>

We process and store metadata.<\/p>

16. Where is the metadata stored?<\/strong><\/p>

It\u2019s stored on Google Cloud Platform (GCP). We offer our customers a choice of GCP locations to store their data. Each location is subject to a different legal environment. The geographic locations are US (default), EU and UK.<\/p>

17. How is my metadata kept secured?<\/strong><\/p>

Data at rest is encrypted with AES-256 algorithm.<\/p>

18. Is my metadata secure during transit?<\/strong><\/p>

Data in transit is encrypted with TLS.<\/p>

19. Who has access to my metadata?<\/strong><\/p>

Engineers responsible for the production environment and Support engineers working on problem resolution may have access to the metadata.<\/div>
The type and level of access granted to individual users is based on the \u201cPrinciple of Least Privilege.\u201d This principle states that users are granted only the level of access absolutely necessary to perform their job functions. Access level is also determined by Role-Based Access Control (RBAC), which limits access based on the role assigned to an individual within the organization.<\/div><\/div>
\u00a0<\/div>

20. How is metadata accessed via Google API?<\/strong><\/p>

This metadata is accessed directly from Google Workspace via HTTPS, the same encryption standard that you use to access Google Workspace.\u00a0<\/span><\/p>

\u00a0<\/span><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Want to know more?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Contact GAT Labs today for a FREE trial or a live demonstration of all our products’ features.
It has never been easier to do more, see more and protect more, wherever your Google Workspace and Chrome users are in the world.<\/b><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t
\n \n Book a Demo<\/span>\n <\/a>\n <\/div>\n
\n \n Free Trial<\/span>\n <\/a>\n <\/div>\n \t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"

Third Party Risk Assessment POLICY AND STANDARDS 1. Is your company UK or EU based (i.e. all servers\/ staff sit within the EU and are therefore under EU GDPR legislation). We operate a distributed platform where customers can choose their data storage location.Our default location is US, but any customer can choose their data to […]<\/p>\n","protected":false},"author":2,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_acf_changed":false,"content-type":"","inline_featured_image":false,"footnotes":""},"class_list":["post-1332","page","type-page","status-publish","hentry"],"acf":[],"yoast_head":"\nThird Party Risk Assessment - GAT for Education<\/title>\n<meta name=\"description\" content=\"POLICY AND STANDARDS1.Is your company UK or EU based (i.e. all servers\/ staff sit within the EU and are therefore under EU GDPR legislation).\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/gatlabs.com\/education\/third-party-risk-assessment\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Third Party Risk Assessment\" \/>\n<meta property=\"og:description\" content=\"POLICY AND STANDARDS1.Is your company UK or EU based (i.e. all servers\/ staff sit within the EU and are therefore under EU GDPR legislation).\" \/>\n<meta property=\"og:url\" content=\"https:\/\/gatlabs.com\/education\/third-party-risk-assessment\/\" \/>\n<meta property=\"og:site_name\" content=\"GAT for Education\" \/>\n<meta property=\"article:modified_time\" content=\"2025-10-06T13:41:05+00:00\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/gatlabs.com\\\/education\\\/third-party-risk-assessment\\\/\",\"url\":\"https:\\\/\\\/gatlabs.com\\\/education\\\/third-party-risk-assessment\\\/\",\"name\":\"Third Party Risk Assessment - GAT for Education\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/gatlabs.com\\\/education\\\/#website\"},\"datePublished\":\"2021-10-23T23:56:00+00:00\",\"dateModified\":\"2025-10-06T13:41:05+00:00\",\"description\":\"POLICY AND STANDARDS1.Is your company UK or EU based (i.e. all servers\\\/ staff sit within the EU and are therefore under EU GDPR legislation).\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/gatlabs.com\\\/education\\\/third-party-risk-assessment\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/gatlabs.com\\\/education\\\/third-party-risk-assessment\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/gatlabs.com\\\/education\\\/third-party-risk-assessment\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/gatlabs.com\\\/education\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Third Party Risk Assessment\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/gatlabs.com\\\/education\\\/#website\",\"url\":\"https:\\\/\\\/gatlabs.com\\\/education\\\/\",\"name\":\"GAT for Education\",\"description\":\"Keep students safe online and get back your time by automating your daily Google Wokspace Admin chores.\",\"publisher\":{\"@id\":\"https:\\\/\\\/gatlabs.com\\\/education\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/gatlabs.com\\\/education\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/gatlabs.com\\\/education\\\/#organization\",\"name\":\"GAT Labs for Education\",\"url\":\"https:\\\/\\\/gatlabs.com\\\/education\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/gatlabs.com\\\/education\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/gatlabs.com\\\/education\\\/wp-content\\\/uploads\\\/2025\\\/10\\\/cropped-GAT-for-education-logo.webp\",\"contentUrl\":\"https:\\\/\\\/gatlabs.com\\\/education\\\/wp-content\\\/uploads\\\/2025\\\/10\\\/cropped-GAT-for-education-logo.webp\",\"width\":648,\"height\":210,\"caption\":\"GAT Labs for Education\"},\"image\":{\"@id\":\"https:\\\/\\\/gatlabs.com\\\/education\\\/#\\\/schema\\\/logo\\\/image\\\/\"}}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Third Party Risk Assessment - GAT for Education","description":"POLICY AND STANDARDS1.Is your company UK or EU based (i.e. all servers\/ staff sit within the EU and are therefore under EU GDPR legislation).","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/gatlabs.com\/education\/third-party-risk-assessment\/","og_locale":"en_US","og_type":"article","og_title":"Third Party Risk Assessment","og_description":"POLICY AND STANDARDS1.Is your company UK or EU based (i.e. all servers\/ staff sit within the EU and are therefore under EU GDPR legislation).","og_url":"https:\/\/gatlabs.com\/education\/third-party-risk-assessment\/","og_site_name":"GAT for Education","article_modified_time":"2025-10-06T13:41:05+00:00","twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/gatlabs.com\/education\/third-party-risk-assessment\/","url":"https:\/\/gatlabs.com\/education\/third-party-risk-assessment\/","name":"Third Party Risk Assessment - GAT for Education","isPartOf":{"@id":"https:\/\/gatlabs.com\/education\/#website"},"datePublished":"2021-10-23T23:56:00+00:00","dateModified":"2025-10-06T13:41:05+00:00","description":"POLICY AND STANDARDS1.Is your company UK or EU based (i.e. all servers\/ staff sit within the EU and are therefore under EU GDPR legislation).","breadcrumb":{"@id":"https:\/\/gatlabs.com\/education\/third-party-risk-assessment\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/gatlabs.com\/education\/third-party-risk-assessment\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/gatlabs.com\/education\/third-party-risk-assessment\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/gatlabs.com\/education\/"},{"@type":"ListItem","position":2,"name":"Third Party Risk Assessment"}]},{"@type":"WebSite","@id":"https:\/\/gatlabs.com\/education\/#website","url":"https:\/\/gatlabs.com\/education\/","name":"GAT for Education","description":"Keep students safe online and get back your time by automating your daily Google Wokspace Admin chores.","publisher":{"@id":"https:\/\/gatlabs.com\/education\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/gatlabs.com\/education\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/gatlabs.com\/education\/#organization","name":"GAT Labs for Education","url":"https:\/\/gatlabs.com\/education\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/gatlabs.com\/education\/#\/schema\/logo\/image\/","url":"https:\/\/gatlabs.com\/education\/wp-content\/uploads\/2025\/10\/cropped-GAT-for-education-logo.webp","contentUrl":"https:\/\/gatlabs.com\/education\/wp-content\/uploads\/2025\/10\/cropped-GAT-for-education-logo.webp","width":648,"height":210,"caption":"GAT Labs for Education"},"image":{"@id":"https:\/\/gatlabs.com\/education\/#\/schema\/logo\/image\/"}}]}},"_links":{"self":[{"href":"https:\/\/gatlabs.com\/education\/wp-json\/wp\/v2\/pages\/1332","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/gatlabs.com\/education\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/gatlabs.com\/education\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/gatlabs.com\/education\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/gatlabs.com\/education\/wp-json\/wp\/v2\/comments?post=1332"}],"version-history":[{"count":44,"href":"https:\/\/gatlabs.com\/education\/wp-json\/wp\/v2\/pages\/1332\/revisions"}],"predecessor-version":[{"id":16945,"href":"https:\/\/gatlabs.com\/education\/wp-json\/wp\/v2\/pages\/1332\/revisions\/16945"}],"wp:attachment":[{"href":"https:\/\/gatlabs.com\/education\/wp-json\/wp\/v2\/media?parent=1332"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}