USCountry-specific compliance
GateTest for United States
US dev shops live inside four overlapping regimes — HIPAA for health, CCPA for consumer data, SOX for finance, PCI-DSS for cards. GateTest's 122 modules catch the technical findings each auditor looks for, in one scan, before code ships.
What devs in United States build with
Stack and host shapes we see across the United States dev market — GateTest is tuned for all of them.
The 3 modules most relevant in United States
A Full scan runs every one of the 122 modules that applies to your repository — these three are the highest-signal for HIPAA + CCPA + SOX + PCI-DSS.
secretsSecurityAWS keys, GitHub tokens, Stripe keys, passwords, private keys, DB strings — caught before commit.
logPiiSecurityCredentials, tokens, request bodies and sensitive identifiers logged in plaintext.
dependenciesSecuritySupply-chain hygiene across npm, pip, Pipenv, Poetry, go.mod, Cargo, Bundler, Composer, Maven, Gradle.
HIPAA + CCPA + SOX + PCI-DSS — what GateTest catches
Each bullet ties a real GateTest module to a specific clause in the United States compliance landscape. Official source →
secretRotationsecretRotation module flags credentials older than 90 days (error) and 30 days (warning) using git-history-aware dating — directly maps to HIPAA's password-management standard.
secretssecrets module catches hardcoded API keys, AWS access tokens, GitHub PATs, Stripe live keys, JWTs and private keys before they reach the repo — the lowest bar for 'reasonable security' under CCPA's private right of action.
ssrfssrf module taints req.body / req.query / req.params and flags when tainted values reach fetch/axios/http.request without an allowlist — the technical SSRF / IDOR class PCI auditors ask about.
prSizeprSize module enforces a per-PR file + line cap so no change lands unreviewably large, and every gate run leaves a timestamped scan record against the commit — the reviewable-change evidence a SOX auditor asks for under change-management controls.
logPiilogPii module flags console.log / logger.info calls that dump req.body, JSON.stringify(user), or template-string interpolation of password/token/jwt — the GDPR/HIPAA logging violation that ships in nearly every codebase.
dependenciesdependencies module scans npm / pip / Poetry / go.mod / Cargo / Bundler / Composer / Maven / Gradle and flags wildcards, 'latest' pins, deprecated packages and missing lockfiles — produces the SBOM-adjacent evidence auditors collect.
Honest limitations
GateTest is a code-quality + security scanner — not a compliance auditor, and it offers no SOC 2 compliance scan and no penetration testing. It reports code-level findings; any SOC 2, HIPAA or ISO audit needs a qualified human assessor.
- GateTest produces technical findings — HIPAA / PCI / SOX audits still require a qualified human assessor (QSA for PCI, OCR for HIPAA).
- Data-residency claims (e.g. 'all data stored in us-east-1') depend on your host config; GateTest doesn't verify host region.
Who hires GateTest in United States
Pricing
Starting at $29 USD — one-time, charged via Stripe at checkout.
Try it on your own repo
$29 Quick scan, no signup. One-time charge per scan — no subscription required (Continuous, $49/mo, is optional if you want every push scanned).
Run a United States scan — $29Also for:United KingdomEuropean UnionAustraliaAotearoa New Zealand