GGateTest

EUCountry-specific compliance

GateTest for European Union

GDPR is the floor. NIS2 widened the scope to thousands more 'essential' and 'important' entities in 2024. DORA hit financial entities in January 2025. GateTest's 122 modules cover the technical-control evidence each one asks for, without forcing a tool sprawl.

Run a scan — from $29See compliance modules

What devs in European Union build with

Stack and host shapes we see across the European Union dev market — GateTest is tuned for all of them.

Popular stack
Next.jsTypeScriptPostgresStripeNode.js
Popular hosts
HetznerVercel (eu region)AWS Frankfurt (eu-central-1)

The 3 modules most relevant in European Union

A Full scan runs every one of the 122 modules that applies to your repository — these three are the highest-signal for GDPR + NIS2 + DORA.

logPiiSecurity

Credentials, tokens, request bodies and sensitive identifiers logged in plaintext.

envVarsSecurity

Cross-references .env.example with process.env reads. Flags NEXT_PUBLIC_* / VITE_* client-bundled keys.

secretsSecurity

AWS keys, GitHub tokens, Stripe keys, passwords, private keys, DB strings — caught before commit.

GDPR + NIS2 + DORA — what GateTest catches

Each bullet ties a real GateTest module to a specific clause in the European Union compliance landscape. Official source →

secrets
GDPR Article 32 — appropriate technical measures

Hardcoded credentials are the single most common Article 32 failure cited in DPA notices. secrets module catches AKIA-prefixed AWS keys, GitHub PAT / OAuth / fine-grained tokens, Stripe live keys, Slack tokens, private-key blocks, JWTs and password-bearing database URLs pre-commit.

logPii
GDPR Article 5(1)(f) — confidentiality

logPii blocks the PII-into-logs class — bare logger calls with password/token/jwt/req.body, JSON.stringify(user), template-string interpolation of sensitive identifiers.

dependencies
NIS2 Article 21 — risk-management measures

dependencies scans npm / pip / go.mod / Cargo / Bundler / Composer / Maven / Gradle and flags wildcards, deprecated packages, missing lockfiles — directly supports the supply-chain measures NIS2 requires.

tlsSecurity
DORA Article 9 — ICT risk management

tlsSecurity flags rejectUnauthorized: false, NODE_TLS_REJECT_UNAUTHORIZED=0, verify=False (Python) — the MITM-shipping pattern DORA explicitly calls out.

envVars
GDPR Article 25 — data-protection by design

envVars flags NEXT_PUBLIC_* / VITE_* / REACT_APP_* prefixes that bundle secrets into client JS, plus declared-but-unused env vars that signal abandoned configuration.

Honest limitations

GateTest is a code-quality + security scanner — not a compliance auditor, and it offers no SOC 2 compliance scan and no penetration testing. It reports code-level findings; any SOC 2, HIPAA or ISO audit needs a qualified human assessor.

  • Data-residency in the EU is a host-level concern — Vercel, AWS and Cloudflare all offer EU-only regions; GateTest doesn't verify your deployment region.
  • Member-state implementations of NIS2 differ on penalties and timelines; check your national transposition.

Who hires GateTest in European Union

Berlin SaaS preparing for a DPA audit after a customer DPIA request
Dutch fintech inside DORA's January 2025 scope expansion
Paris e-commerce shop needing CNIL-defensible technical controls

Pricing

Starting at $29 USD — one-time, charged via Stripe at checkout.

Quick
$29
4 modules
Full
$99
All 122 modules — scan only
Scan + Fix
$199
+ AI auto-fix PR + pair review
Forensic
$399
+ per-finding diagnosis + CISO report
CLI is MIT-licensedGitHub Action on the GitHub Marketplace

Try it on your own repo

$29 Quick scan, no signup. One-time charge per scan — no subscription required (Continuous, $49/mo, is optional if you want every push scanned).

Run a European Union scan — $29

Also for:United StatesUnited KingdomAustraliaAotearoa New Zealand