What GateTest catches, by regulation.

Compliance is a programme, not a tool. But every major regime has a list of code-level findings auditors sample — secrets in source, missing TLS, PII in logs, unrotated credentials, vulnerable dependencies. GateTest catches those before the auditor sees them.

Every page below ties specific GateTest findings to specific clauses of the regulation. We also publish what GateTest does NOT cover — physical security, contracts, training — because compliance honesty matters.