NormGap Check

NormGap Check lets you look up an IT service provider and see an automated assessment of which legal domains it likely touches — GDPR (data protection), NIS2 (cybersecurity), DORA (financial resilience), the AI Act, and third-country transfer risk (Schrems II). It's sourced from the MGLA analysis and Token Law.

Assessments are generated in part by AI-assisted analysis and are informational only — not legal advice, and not binding on any authority, provider, or you. They're a starting point for your own due diligence, not a substitute for it. See the AI Transparency Notice for details.

Personal data is encrypted at rest using a hybrid post-quantum scheme (ML-KEM-768 + X25519 + AES-256-GCM), and the decryption key never leaves our on-premises server — not even to our own cloud infrastructure. Requests to access or erase your data require strong identity verification via an EU Digital Identity Wallet, so only you can act on your own data.

No — searching and viewing existing providers works without an account. You only need one to add a new provider, save document-check history, or exercise GDPR rights.

It's an EU-standard digital identity credential (eIDAS 2.0). You can use it as an alternative way to log in, and it's required to verify your identity before we act on an access, erasure, or consent-withdrawal request for your personal data — this protects you from someone else falsely claiming to be you.

Go to "My rights" in the menu. Access (Art. 15), erasure (Art. 17), and consent withdrawal (Art. 7.3) all require EUDI Wallet verification first. Access requests return a signed, downloadable record (JSON and PDF).

Strictly necessary cookies (staying signed in, security) are always on and need no consent. Advertising cookies (Google AdSense and partner ads) are off by default and only load if you accept them — change your choice anytime via "Cookie settings" in the footer.

At least 30 days, currently kept for up to 90 days by default before automatic deletion. The uploaded file's content is never sent to or stored on our server — only its name and size, alongside the analysis result.

Use "Forgot password?" on the login screen. We'll email a reset code to your account's address if it exists — for privacy, we don't reveal whether a given email is registered.

Email privacy@normgap.com for anything related to your data or privacy. For AI-specific questions, see the AI Transparency Notice, which lists the same contact.