Security & data

Last reviewed: August 2026

We are a young product, so this page claims less than most security pages — but everything on it is exact. No badge wall, no borrowed certificates.

Where the data lives

Your data is stored in the European Union. The database runs on Supabase (managed PostgreSQL) and the application is served by Vercel. Encryption in transit (TLS) and at rest is the standard of those platforms — we state it as their work, not as our own audit.

Who can see what

Every organisation's data is isolated at the database row level: your deals, messages, documents and cabinet are readable only by your organisation. What is public is exactly what you publish — the listing itself. Guests browsing the market see listings and nothing else.

What the AI reads, and where it goes

Invoice scanning and the assistant are powered by Anthropic. When you scan a document or ask a question, that content is sent to Anthropic's API for processing. Under Anthropic's commercial terms, API data is not used to train their models.

AI features are optional — a listing can always be created by hand.

Payments and the deal itself

We never hold the money in a deal. Buyer and seller invoice each other directly under the contract they conclude — the goods and the funds do not pass through WineGate.

Subscriptions are billed through Stripe on the web and through Apple and Google billing in the mobile apps. Card details never touch our servers.

Honestly: what we hold, and what we don't

WineGate does not yet hold its own SOC 2 or ISO 27001 certification — an audit of our own is planned as the company grows. The infrastructure we build on (Supabase, Vercel, Stripe) holds those certifications for their platforms.

We would rather tell you this plainly than decorate the page with other people's badges.

GDPR and your rights

WineGate is operated by PorteVin OÜ, an Estonian company — EU jurisdiction, GDPR applies in full. You can delete your account and its data yourself, and a data processing agreement is available on request.

• Operator: PorteVin OÜ · reg. no. 17473145 · Tallinn
• Privacy: Privacy policy
• Deletion: Delete your account

Where the numbers come from

Every excise and VAT value on the market carries its source and effective date: the DG TAXUD excise duty tables, the TEDB database and national finance portals. Rates are re-verified on each official publication — twice a year, in January and July. This is the same table that prices every listing and powers the free calculator.

hello@winegate.app

A question this page doesn't answer?

Write to us — a person reads it, not a queue. hello@winegate.app