Privacy: Gate IdP

Gate IdP is the identity and authentication service of AM25, S.A.S. de C.V. (hereinafter, “AM25”), used by AM25 personnel, clients, and users within their organizations to access integrated applications.

Accounts are created exclusively by an AM25 administrator. Gate IdP does not offer public account registration.

Information Processed and Purposes

Gate IdP retains first and last names, email address, profile photo when uploaded by the user, organization, and an authorship attribute that distinguishes the client’s account from the accounts of that client’s users. It processes this information to identify users and provide authentication to integrated applications. It also processes the information necessary for authentication, session maintenance, password recovery, and the prevention of unauthorized access.

The processing of personal data is governed by AM25’s Data Protection Policy. This privacy policy supplements those provisions with details specific to Gate IdP.

Authentication and Integrated Applications

Gate IdP uses passwords and one-time passwords (OTP) and is built on OAuth 2.0 and OpenID Connect (OIDC). It may send transactional emails to enable password recovery.

Integrated applications receive the account’s identity information from Gate IdP: first and last names, email address, profile photo when available, organization, and the corresponding authorship attribute. Each application applies its own roles and permissions; authentication through Gate IdP does not in itself grant access to all applications or all of their resources.

Each application’s processing of the information it receives is described in its respective privacy policy. Gate IdP provides identity and authentication, while each application determines access to its features and resources.

Cookies and Security Records

Gate IdP uses session cookies necessary for authentication and session maintenance. It does not use advertising or analytics cookies.

Gate IdP temporarily retains information about sign-ins, failed attempts, IP addresses, device, browser, and security changes to prevent brute-force attacks and protect accounts. These records are used for security purposes, not for advertising or commercial tracking.

External Services

Gate IdP uses Cloudflare R2 to store profile photos uploaded by users. Images and the information necessary for their storage are processed through this service.

Gate IdP uses Postmark to send transactional password recovery emails. The recipient’s email address and the information necessary to generate and deliver the message are processed through this service.

Gate IdP uses Cloudflare Turnstile on the sign-in form to detect automated traffic and protect access against abuse. This verification takes place before continuing with the authentication process, including the second factor when enabled. To provide this service, Cloudflare processes technical signals, such as the IP address and information about the browser and connection, in accordance with its applicable policies.

Account Administration, Retention, and Deletion

Account administration, including modification, deactivation, and deletion, is handled exclusively by an AM25 administrator. Users may submit requests concerning their data and exercise their rights through the mechanisms established in AM25’s Data Protection Policy; self-service account deletion is not offered.

The retention and deletion of account information and temporary security records are governed by AM25’s Data Protection Policy, according to the purposes of processing and applicable obligations. This policy does not establish a specific retention period.

Deactivating or deleting a Gate IdP account does not in itself imply the deletion of data retained by integrated applications. The processing and retention of that data are governed by the policies and terms applicable to each application.

Artificial Intelligence and Other Uses

Gate IdP does not process information through artificial intelligence. AM25 does not sell data processed through Gate IdP or use it for advertising or training artificial intelligence models.