Built so a key can't be passed along

• Each pass has its own secret. The code on screen is derived from it with HMAC-SHA256 and changes every 10 seconds by default, so a screenshot stops working almost immediately.
• Before a pass appears, the guest confirms a 6-digit code sent by text, email, or WhatsApp to the phone or email the resident entered. Codes expire after 10 minutes and allow 5 tries, and requests are rate limited.
• A pass only works at the property it was issued for, inside its visit window, and stops the moment a resident or admin revokes it.

• There are no passwords to leak. Residents and admins sign in with one-time codes, stored hashed.
• Sessions live in HttpOnly, SameSite cookies, with an extra guard against cross-site requests.
• GateWing is invite-only: accounts are created by a community's own administrators.
• Roles keep people in their lane. Residents see their own property, site admins their site, and organization admins their portfolio.

• Readers and edge appliances enroll with single-use keys. Their access tokens are stored only as keyed hashes, so they can't be read back from our database.
• An edge appliance holds what it needs to check active passes on site, so entrances keep working through an internet outage, and it syncs every decision when it reconnects.

• GateWing runs on Google Cloud in the United States.
• Traffic is encrypted in transit with TLS, and data is encrypted at rest by Google Cloud.
• Secrets are kept out of source code and derived per purpose from a protected master key.

• Every allow, deny, and expiry is logged with the time, entrance, credential, and reader.
• Administrative changes are recorded in an audit trail your team can review.

If you think you've found a security issue, email [email protected] with the details. Please give us a chance to fix it before sharing it publicly. See our Privacy Policy for how we handle personal information.