Prevents falling behindOff-the-shelf productEstablished, AI retrofitted

GitBook

GitBook Inc. ·www.gitbook.com· As of: 2026-09-01

Publishes product documentation and help articles as a searchable website, keeps the text tied to the source code through a two-way sync with GitHub or GitLab, and answers reader questions in place through a language-model search.

Work through this tool with an AI

Our verdict

Searchable documentation creates no edge, because every competitor can rent the same platform. Without it you get requests a single paragraph would have answered, and you are missing from the answers of the assistant systems that now sit between customer and vendor. The difference comes from the text itself and from the question of who owns it when the platform changes. GitBook answers the second question well, because syncing into your own repository is part of the free plan. The first question no tool answers.

Evidence:As of 2026-09-01Plan prices: free, Premium 65 US dollars per site per month, Ultimate 249 US dollars, both on annual billing, plus 12 US dollars per user per month; Enterprise on requestOpen sourceAs of 2026-09-01SAML sign-in, a custom contract and legal and security review sit in the Enterprise plan alone; a selectable hosting location appears in no planOpen sourceAs of 2026-09-01Customer data sits in data centres in the United States; pages and assets may be cached in other geographies by the CDNOpen sourceAs of 2026-09-01The subprocessor list has 19 entries, all with the United States as the processing location; Clearbit and Vercel are named in the security FAQ and are missing from the listOpen sourceAs of 2026-09-01Section 8.4 of the terms of service incorporates the data processing addendum; section 7.3 allows 60 days for an export after termination and promises no deletionOpen sourceAs of 2026-09-01The data processing addendum incorporates the standard contractual clauses under implementing decision 2021/914 in modules one to three, chooses Dutch law and still names Privacy Shield in section 4.2 as a permissible transfer solutionOpen sourceAs of 2026-09-01The AI policy rules out training on customer content, names OpenAI as the processor, and expressly carves GitBook Agent, Channels and the "Open in ChatGPT / Claude" action out of its commitmentsOpen sourceAs of 2026-09-01The compliance page lists SOC 2 Type II alone, with Prescient Assurance as the auditor and the report on request; ISO/IEC 27001 is not thereOpen sourceAs of 2026-09-01A blog post dated 29 September 2023 announces SOC 2 Type II and ISO/IEC 27001 and refers to the sales team for the reportsOpen sourceAs of 2026-09-01Reading organization audit events requires an active Enterprise plan, is restricted to administrators and vendor staff and returns at most 100 events per page; no retention period is statedOpen sourceAs of 2026-09-01The organization audit log was announced in the changelog on 14 August 2026 as a beta for Enterprise; the most recent release entry is dated 27 August 2026Open sourceAs of 2026-09-01The French company register lists GITBOOK, SIREN 829 909 464, registered on 1 June 2017 and closed on 3 November 2023Open sourceAs of 2026-09-01Mintlify charges nothing for Starter and 450 US dollars a month for Pro with unlimited editor seatsOpen sourceAs of 2026-09-01The vendor's own status page reports availability of 99.86 percent for the application and 99.98 percent for published content from June to August 2026Open source

Who it fits

Solo

suitable

The free plan covers this case completely, including sync with GitHub or GitLab, preview deployments and interactive API playgrounds. Anyone writing alone pays nothing and keeps the text as Markdown in their own repository.

Mid-market

suitable

Premium costs 65 US dollars per site per month on annual billing, plus 12 US dollars per user per month. That carries a branded public documentation site with a custom domain, redirects and analytics. Moving up to the AI features costs four times as much, so before booking it, ask how many requests the assistant actually absorbs.

Enterprise

suitable with caveats

Everything a procurement department checks sits in the Enterprise plan with no public price: SAML sign-in, a custom contract, legal and security review, plus the organization audit log that has been in beta since 14 August 2026. A selectable EU hosting location exists on no plan, including that one.

Buy, switch or build

Off-the-shelf

The help centre inside the helpdesk

The established counterpart is the help centre that ships with the helpdesk; at Zendesk it is called Guide. Large companies stay with it because article, ticket, rule and reporting live in one permission model, and because the path from an unanswered article to a ticket works without a second login. You pay for that with an authoring environment developers avoid, and with text that sits in the helpdesk's database rather than in a repository the customer owns.

AI-native

Documentation built for language models

Mintlify starts from the same idea and aims its delivery at language models and agents from the outset. The price is cut differently: Starter costs nothing and includes a custom domain, reader authentication and an MCP server for five editor seats, while Pro sits at 450 US dollars a month for unlimited seats, as of 1 September 2026. At GitBook the same scope hangs off two plan steps and off the number of people. What you give up is breadth: fewer authoring features for staff without Git, a younger vendor and a shorter evidence trail on regulatory questions.

Build it yourself

Your own documentation site from building blocks

Building this yourself is unusually cheap, because the blocks are ready. Astro renders the pages, Sanity holds the text for everyone who does not use Git, Cloudflare Pages serves it, Ory protects the non-public parts, and LiteLLM as a model gateway plus Langfuse as a log belong in front of the answering feature. The build runs with Claude Code or Cursor. Assuming a day rate of 1,000 euros, a serviceable first version takes eight to twelve person-days, plus under 50 euros a month for delivery and model calls at low load. It fails in three places: at search, which is weaker than the bought one after the first month; at redirects and versioning, which nobody wants to maintain; and at upkeep, once the builder leaves the building.

Our advice

  • Solo: Buy, free plan. Syncing into your own repository is already included there.
  • Mid-market: Buy, Premium. Before moving up to Ultimate, measure how many requests the Assistant actually absorbs.
  • Enterprise: Buy only on an Enterprise contract, and write hosting location, deletion deadline after termination and audit log retention into it.

Who is behind it

Staying power: Established

The service has been running for years and ships weekly. The contracting entity is a Delaware corporation. The French subsidiary that the vendor still names in its own security pages has been recorded as closed in the French register (Registre national des entreprises) since 3 November 2023; the vendor names neither an EU entity nor a representative under Article 27 GDPR anywhere.

  • Registration of the French entity: GITBOOK, SIREN 829 909 464, registered on 1 June 2017, last registered office 3 Cours Charlemagne, 69002 LyonAs of 2026-09-01The French company register lists GITBOOK, SIREN 829 909 464, registered on 1 June 2017 and closed on 3 November 2023Open source · As of 2026-09-01
  • Register status of the same entity: recorded as closed since 3 November 2023 (état administratif "cessé"), while the vendor's security pages still named it as a subsidiary on 1 September 2026As of 2026-09-01The French company register lists GITBOOK, SIREN 829 909 464, registered on 1 June 2017 and closed on 3 November 2023Open source · As of 2026-09-01
  • Contracting entity: GitBook Inc., a Delaware corporation; the terms of service name no EU contracting entityAs of 2026-09-01Section 8.4 of the terms of service incorporates the data processing addendum; section 7.3 allows 60 days for an export after termination and promises no deletionOpen source · As of 2026-09-01
  • Certification: SOC 2 Type II, audited by Prescient Assurance, report available on request through a trust portal; ISO/IEC 27001 was announced on the vendor's own blog on 29 September 2023 and since then appears only on the pricing pageAs of 2026-09-01The compliance page lists SOC 2 Type II alone, with Prescient Assurance as the auditor and the report on request; ISO/IEC 27001 is not thereOpen source · As of 2026-09-01
  • Release cadence: public changelog with weekly entries, most recently on 27 August 2026, with yearly archives going back to 2023As of 2026-09-01The organization audit log was announced in the changelog on 14 August 2026 as a beta for Enterprise; the most recent release entry is dated 27 August 2026Open source · As of 2026-09-01
  • Operations: per the vendor's own status page for June to August 2026: application 99.86 percent, published content 99.98 percent, no open incidentsAs of 2026-09-01The vendor's own status page reports availability of 99.86 percent for the application and 99.98 percent for published content from June to August 2026Open source · As of 2026-09-01

Cost of leaving: Low

The text sits as Markdown in your own repository on GitHub or GitLab, and that sync is part of the free plan. The substance therefore leaves without negotiation. What stays behind is the publication: redirects, access control for non-public pages, the analytics and the accumulated record of questions and answers in AI Insights. After termination the terms of service allow 60 days for an export.

Regulation and data

How to read the traffic lightHow to read the traffic lightThe traffic light rates how well a point is evidenced, not how good the tool is. It draws only on the value, note and source held in the profile. Where a statement is missing, it rates the absence, not a guess. A well-reasoned "unclear" on a point that matters little for this tool is yellow. A missing source on a point that decides whether you can use it at all is red.documented, no condition attacheddocumented, tied to a conditiondocumented, but unfavourableopen on a point that decides usability
Data processing agreementScale for this point: Data processing agreementdocumented, no condition attached: Auftragsverarbeitungsvertrag öffentlich abrufbar und ohne weitere Bedingung Bestandteil des Vertrags; oder er entfällt nachvollziehbar begründet, weil kein Anbieter Kundendaten verarbeitet.documented, tied to a condition: Vertrag existiert, ist aber an einen Tarif gebunden, nur nach Anfrage einsehbar oder allein in den Nutzungsbedingungen geregelt statt als eigenes Dokument.documented, but unfavourable: Kein Auftragsverarbeitungsvertrag im üblichen Sinn: entweder weil der Anbieter für das Kerngeschäft eigenständig Verantwortlicher ist und stattdessen eine andere Konstruktion gilt, oder weil öffentlich offen bleibt, ob überhaupt einer angeboten wird.open on a point that decides usability: Weder ein Vertrag noch ein dokumentierter Weg zu einem Vertrag; der Einkauf hätte nichts, worauf er sich stützen kann.documented, no condition attachedyes, publicly downloadable as a PDF and incorporated into the terms of serviceAs of 2026-09-01The data processing addendum incorporates the standard contractual clauses under implementing decision 2021/914 in modules one to three, chooses Dutch law and still names Privacy Shield in section 4.2 as a permissible transfer solutionOpen sourceSection 8.4 of the terms of service expressly incorporates the data processing addendum, the document hangs off the privacy statement and needs neither a request nor a particular plan. The linked version carries the file name 2022-gitbook-dpa.pdf and is therefore older than the AI features the vendor runs today.As of 2026-09-01
Storage locationScale for this point: Storage locationdocumented, no condition attached: EU-Speicherort ohne Zusatzkosten und ohne Tarifbindung, oder der Ort ist vollständig selbst bestimmbar, weil das Werkzeug im eigenen Betrieb läuft.documented, tied to a condition: EU-Speicherort möglich, aber an einen Tarif, einen gesondert zu aktivierenden Zusatz oder einen Umzug in eine getrennte Umgebung gebunden; oder die EU-Region ist nicht die Voreinstellung.documented, but unfavourable: Kein EU-Speicherort, der Ort ist aber eindeutig benannt, sodass die Folgen bewertbar sind.open on a point that decides usability: Der Speicherort ist öffentlich nicht benannt oder vom Kunden nicht steuerbar, sodass sich die Verarbeitung nicht verorten lässt.documented, but unfavourabledata centres in the United States, no selectable EU hosting location on any planAs of 2026-09-01Customer data sits in data centres in the United States; pages and assets may be cached in other geographies by the CDNOpen sourceThe vendor names the location clearly: customer data sits in data centres in the United States, and HTML pages and assets may be cached in other geographies by the CDN. A selectable hosting location appears in none of the four plans on the pricing page, Enterprise included. The consequences are therefore assessable, but the customer has no choice.As of 2026-09-01
SubprocessorsScale for this point: Subprocessorsdocumented, no condition attached: Vollständige öffentliche Liste der Unterauftragnehmer mit Zweck und Land; oder es gibt keine, weil das Werkzeug im eigenen Betrieb läuft.documented, tied to a condition: Liste existiert und ist benannt, aber nur nach Anfrage oder nach Zugang zu einem Vertrauensportal einsehbar, oder sie nennt Zweck und Land nicht vollständig.documented, but unfavourable: Keine geführte Liste; namentlich stehen nur einzelne Dienste in der Datenschutzerklärung, überwiegend solche der eigenen Website.open on a point that decides usability: Weder eine Liste noch eine Nennung der Verarbeiter des Produkts, und kein dokumentierter Weg, sie zu erfahren.documented, tied to a conditionpublic list of 19 entries, each with purpose and country, all of them the United StatesAs of 2026-09-01The subprocessor list has 19 entries, all with the United States as the processing location; Clearbit and Vercel are named in the security FAQ and are missing from the listOpen sourceThe list names Google Cloud and Firebase, Cloudflare, Planetscale, Clickhouse, Turbopuffer and OpenAI among others. Complete it is not: the same vendor's security FAQ names Clearbit for sign-up risk evaluation and Vercel for hosting, and neither appears on the list. Anyone using it as the basis for the right to object under the data processing addendum is working from a chain that is too short.As of 2026-09-01
Third-country transferScale for this point: Third-country transferdocumented, no condition attached: Keine Übermittlung in ein Drittland, oder die Übermittlung findet statt und die Grundlage ist benannt und im Vertrag verankert, etwa Standardvertragsklauseln, Angemessenheitsbeschluss oder EU-US-Datenschutzrahmen.documented, tied to a condition: Übermittlung findet statt, eine Grundlage ist genannt, aber ohne Zuordnung, welcher Empfänger auf welcher Grundlage arbeitet.documented, but unfavourable: Übermittlung findet statt und die eigenen Unterlagen widersprechen sich, oder die genannte Grundlage bezieht sich erkennbar nur auf einen Randbereich wie die Marketing-Website.open on a point that decides usability: Übermittlung findet erkennbar statt und eine Grundlage wird nirgends genannt.documented, tied to a conditionprocessing in the United States, based on the standard contractual clauses under modules one, two and threeAs of 2026-09-01The data processing addendum incorporates the standard contractual clauses under implementing decision 2021/914 in modules one to three, chooses Dutch law and still names Privacy Shield in section 4.2 as a permissible transfer solutionOpen sourceThe addendum incorporates the Commission's clauses under implementing decision 2021/914, chooses Dutch law and Dutch courts, and covers Switzerland and the United Kingdom separately. Two passages are out of date: section 4.2 still lists "Privacy Shield" as a permissible transfer solution, although the Court of Justice of the European Union invalidated it on 16 July 2020, and the privacy statement invokes the Privacy Shield principles. The vendor never mentions the EU-US Data Privacy Framework. Which recipient operates on which basis is likewise stated nowhere.As of 2026-09-01
Training on customer dataScale for this point: Training on customer datadocumented, no condition attached: Vertraglich oder in der Datenschutzerklärung ausdrücklich ausgeschlossen, mit Erstreckung auf die eingesetzten Modellanbieter; oder es gibt keine Datenübertragung an einen Anbieter.documented, tied to a condition: Ausschluss ab einem bestimmten Tarif, oder die Zusage steht nur auf einer Dokumentationsseite statt im Vertrag, oder die Frage stellt sich für das Werkzeug sachlich kaum und der Anbieter schweigt dazu.documented, but unfavourable: Nutzung ist die Voreinstellung und nur ein Widerspruch beendet sie; oder der Anbieter trainiert eigene Modelle auf bereinigten Kundendaten.open on a point that decides usability: Keine Aussage, obwohl das Werkzeug KI-Funktionen auf Kundeninhalten betreibt.documented, tied to a conditiontraining on customer content is ruled out, but the commitment sits on a documentation page rather than in the contractAs of 2026-09-01The AI policy rules out training on customer content, names OpenAI as the processor, and expressly carves GitBook Agent, Channels and the "Open in ChatGPT / Claude" action out of its commitmentsOpen sourceThe AI policy rules out training on customer content, for the vendor's own models as well as for OpenAI, and extends that commitment to all content whether or not AI features are switched on. Under section 8.4 of the terms of service, however, only the security documentation and the data processing addendum are incorporated into the contract, and the AI policy is not. The vendor names two carve-outs itself: GitBook Agent and Channels run without zero data retention at OpenAI, and the "Open in ChatGPT / Claude" action forwards the page under the visitor's own account, where the vendor's commitments expressly do not apply.As of 2026-09-01
Retention and deletionScale for this point: Retention and deletiondocumented, no condition attached: Löschfristen nach Vertragsende beziffert und die Löschung oder Rückgabe zugesagt; oder die Fristen bestimmt der Betreiber selbst, weil das Werkzeug im eigenen Betrieb läuft.documented, tied to a condition: Löschung ist zugesagt, die Fristen sind aber nur teilweise beziffert, oder Sicherungskopien sind ausdrücklich ausgenommen.documented, but unfavourable: Nur der Grundsatz der Erforderlichkeit ohne jede Frist nach Vertragsende, oder Fristen sind allein für Randbereiche wie Website-Protokolle genannt.open on a point that decides usability: Keine Aussage zu Aufbewahrung und Löschung.documented, but unfavourableno deletion deadline for customer content after termination; 60 days for the export, 90 days for the user profile on requestAs of 2026-09-01Section 8.4 of the terms of service incorporates the data processing addendum; section 7.3 allows 60 days for an export after termination and promises no deletionOpen sourceThe heading is worth a look here. Section 3.6 of the data processing addendum is titled "Obligation to Delete and Return Personal Data", while the text below it grants only the right to delete customer data yourself during the term. Annex 1 points to exactly that section when asked for the retention period. Section 7.3 of the terms of service allows 60 days for an export after termination and promises no deletion. In the end only a peripheral item carries a number: the user profile, deleted within 90 days of a request.As of 2026-09-01
CertificationsScale for this point: Certificationsdocumented, no condition attached: Mehrere anerkannte Nachweise, benannt mit Norm, Fassung und Geltungsbereich, und bezogen auf den Anbieter selbst.documented, tied to a condition: Ein anerkannter Nachweis für den Anbieter belegt, der Bericht aber nur auf Anfrage, oder der Nachweis hängt an einem Tarif, oder der Geltungsbereich bleibt teilweise offen.documented, but unfavourable: Nur pauschale Nennung ohne Norm-Fassung und Geltungsbereich, oder bloße Selbstauskunft, oder die Nachweise gehören dem Infrastrukturanbieter statt dem Anbieter, oder der Prüfzeitraum ist erkennbar veraltet, oder die eigenen Angaben widersprechen sich.open on a point that decides usability: Kein Nachweis genannt und keine Sicherheits- oder Vertrauensseite vorhanden.documented, but unfavourableSOC 2 Type II documented with a named auditor; ISO/IEC 27001 appears on the pricing page and not on the compliance pageAs of 2026-09-01The compliance page lists SOC 2 Type II alone, with Prescient Assurance as the auditor and the report on request; ISO/IEC 27001 is not thereOpen sourceThe compliance page names only the SOC 2 Type II attestation, identifies Prescient Assurance as the auditor and releases the report on request through a trust portal. The pricing page meanwhile carries the line "ISO 27001 & SOC 2 certified" across all four plans, and a blog post dated 29 September 2023 announces both certifications. The version of the standard, the scope, the certificate number and the certification body for ISO/IEC 27001 appear nowhere, and the compliance page has not picked up the point in three years. Anyone who needs the evidence should request it before signing.As of 2026-09-01
EU AI Act, Article 50Scale for this point: EU AI Act, Article 50documented, no condition attached: Der Anbieter macht eine belegte Aussage, die die eigene Pflicht trägt, etwa Modelldokumentation und Zertifizierung nach ISO/IEC 42001; oder das Werkzeug enthält nachvollziehbar begründet kein KI-System im Sinne der Verordnung.documented, tied to a condition: Der Anbieter äußert sich zur Verordnung oder ordnet die eigene Funktion ein, eine benannte Zusage zu den Transparenzpflichten aus Artikel 50 fehlt aber; oder das Werkzeug enthält kein KI-System, das gegenüber Menschen auftritt, und der Anbieter schweigt.documented, but unfavourable: Das Produkt enthält KI-Funktionen, der Anbieter schweigt dazu oder trägt ein Selbstetikett ohne Nachweis; die Kennzeichnung ist vom Betreiber aber selbst setzbar.open on a point that decides usability: KI spricht im Produkt unmittelbar mit Endkunden und der Anbieter sagt zu Artikel 50 nichts; die Kennzeichnung lässt sich ohne Zusage des Anbieters nicht sicher setzen.documented, but unfavourableunclearThe European regulation on artificial intelligence appears nowhere in the terms of service, the privacy statement, the AI policy, the security pages or the pricing page, although GitBook Assistant speaks directly to visitors on published sites. These five documents were reviewed in full on 1 September 2026. Labelling under Article 50 therefore stays with the operator, who can place it on their own documentation site; the feature can be switched off per organization and per site.no source given · As of 2026-09-01
Audit loggingScale for this point: Audit loggingdocumented, no condition attached: Nachvollziehbares Protokoll über Zugriffe und Änderungen in allen Tarifen enthalten, mit benannter Frist und Ausleitung in eigene Systeme; oder die Nachvollziehbarkeit liegt vollständig in eigener Hand, weil das Werkzeug im eigenen Betrieb läuft.documented, tied to a condition: Protokoll vorhanden, aber an einen höheren Tarif oder einen kostenpflichtigen Zusatz gebunden, oder die Ausleitung fehlt in den unteren Stufen; Reichweite und Frist sind benannt.documented, but unfavourable: Protokolle sind nur anbieterseitig beschrieben, oder Reichweite und Frist bleiben offen, sodass sich Nachweispflichten nicht planen lassen.open on a point that decides usability: Öffentlich nicht belegt, ob der Kunde überhaupt ein auswertbares Protokoll erhält.documented, but unfavourableorganization audit log only on the Enterprise plan, in beta since 14 August 2026, with no stated retention periodAs of 2026-09-01Reading organization audit events requires an active Enterprise plan, is restricted to administrators and vendor staff and returns at most 100 events per page; no retention period is statedOpen sourceThe API reference is explicit: reading the events requires an active Enterprise plan, and access is limited to organization administrators and vendor staff. Recorded are the time, the action, the actor, the entry point and the affected resource, retrieved page by page at a maximum of 100 events. How long events are kept appears neither in the API reference nor in the changelog, and the feature comparison on the pricing page does not mention the point at all. Evidence obligations cannot be planned on that basis.As of 2026-09-01

What it really costs

Entry price

The free plan carries one site with editor, sync to GitHub or GitLab, preview deployments and interactive API playgrounds. Premium costs 65 US dollars per site per month on annual billing, Ultimate 249 US dollars. On top of that come 12 US dollars per user per month. Enterprise is priced on request only.As of 2026-09-01Plan prices: free, Premium 65 US dollars per site per month, Ultimate 249 US dollars, both on annual billing, plus 12 US dollars per user per month; Enterprise on requestOpen source

As of 2026-09-01

What gets expensive

In two places. First the vendor bills per site and additionally per user, so every separately documented product triggers the site price again. Second the Assistant, AI Insights, GitBook Agent and access control for non-public pages only start in Ultimate, which is four times the Premium price. To put numbers on it: fifteen people and two public documentation sites with the Assistant come to 678 US dollars a month on annual billing, and SAML sign-in, a custom contract and the audit log are not yet included. Those sit one step higher in Enterprise, with no public price.

What it displaces

  • The manual as a PDF attached to an email
  • Documentation in a wiki nobody outside the company may see
  • Answers that exist only in the history of the support inbox

Interfaces

  • Two-way sync with GitHub and GitLab, from the free plan upwards
  • REST API for content, organizations and change requests
  • Markdown version of every page by appending .md to its URL
  • llms.txt as an index of the documentation for language models
  • MCP server per site, switchable through the page actions
  • Audit event API for organizations, only with an active Enterprise plan

Matching methods

  • Service BlueprintingA blueprint shows where the customer gets through on their own and from which point a person takes over, and a knowledge base is precisely the step you push in front of that handover.
  • Regulatory Density TestThe test asks how much regulation attaches to a process, and here the answer decides the purchase: US-only hosting with no choice carries a public product documentation site and does not carry a knowledge base holding customer data.
  • "Context: Moat or Wall?" TestThe test separates what creates an edge from what merely keeps you level, and a rented documentation platform visibly belongs to the second group, while the text inside it can belong to the first.

Alternatives

Sources

  1. 1.Plan prices: free, Premium 65 US dollars per site per month, Ultimate 249 US dollars, both on annual billing, plus 12 US dollars per user per month; Enterprise on request (opens in a new tab)gitbook.com/pricing · As of 2026-09-01
  2. 2.Customer data sits in data centres in the United States; pages and assets may be cached in other geographies by the CDN (opens in a new tab)gitbook.com/…/security-faq · As of 2026-09-01
  3. 3.The subprocessor list has 19 entries, all with the United States as the processing location; Clearbit and Vercel are named in the security FAQ and are missing from the list (opens in a new tab)gitbook.com/…/subprocessors · As of 2026-09-01
  4. 4.Section 8.4 of the terms of service incorporates the data processing addendum; section 7.3 allows 60 days for an export after termination and promises no deletion (opens in a new tab)gitbook.com/docs/policies/terms · As of 2026-09-01
  5. 5.The data processing addendum incorporates the standard contractual clauses under implementing decision 2021/914 in modules one to three, chooses Dutch law and still names Privacy Shield in section 4.2 as a permissible transfer solution (opens in a new tab)gitbook.com/docs/policies/privacy-and-security/statement · As of 2026-09-01
  6. 6.The AI policy rules out training on customer content, names OpenAI as the processor, and expressly carves GitBook Agent, Channels and the "Open in ChatGPT / Claude" action out of its commitments (opens in a new tab)gitbook.com/docs/policies/policies/gitbook-ai-policy · As of 2026-09-01
  7. 7.The compliance page lists SOC 2 Type II alone, with Prescient Assurance as the auditor and the report on request; ISO/IEC 27001 is not there (opens in a new tab)gitbook.com/…/security-as-a-company-value · As of 2026-09-01
  8. 8.A blog post dated 29 September 2023 announces SOC 2 Type II and ISO/IEC 27001 and refers to the sales team for the reports (opens in a new tab)gitbook.com/blog/gitbook-security-soc2-iso27001 · As of 2026-09-01
  9. 9.Reading organization audit events requires an active Enterprise plan, is restricted to administrators and vendor staff and returns at most 100 events per page; no retention period is stated (opens in a new tab)gitbook.com/…/list-organization-audit-events · As of 2026-09-01
  10. 10.The organization audit log was announced in the changelog on 14 August 2026 as a beta for Enterprise; the most recent release entry is dated 27 August 2026 (opens in a new tab)gitbook.com/docs/changelog/readme · As of 2026-09-01
  11. 11.The French company register lists GITBOOK, SIREN 829 909 464, registered on 1 June 2017 and closed on 3 November 2023 (opens in a new tab)recherche-entreprises.api.gouv.fr/search?q=gitbook · As of 2026-09-01
  12. 12.Mintlify charges nothing for Starter and 450 US dollars a month for Pro with unlimited editor seats (opens in a new tab)mintlify.com/pricing · As of 2026-09-01
  13. 13.The vendor's own status page reports availability of 99.86 percent for the application and 99.98 percent for published content from June to August 2026 (opens in a new tab)gitbookstatus.com · As of 2026-09-01

Last reviewed: 2026-09-01 by Dr. Oliver Gausmann, Convios GmbH

Details out of date? Let us know.

From tool to decision

The offer that fits this tool

A tool profile tells you what the tool does and what it means for compliance. Whether it gets priority in your company is a management decision, and it takes one working day: the executive AI workshop ranks your initiatives by business value, risk, data readiness and ownership.