Security Rules for Accounts, Numbers, QR Codes and Phones

Courtesy translation. In case of discrepancy, the Italian text prevails.

This document brings together the practical security obligations of anyone using the BGates Service: the Account password, the phone number that opens an Entrance, QR codes, the Device, and what to do when you lose a phone, change your number or suspect that someone has got in where they should not have.

It is written as a set of instructions, not principles: where you read a verb in the imperative, it is something to do, and in many cases something to do on the same day.

It covers the GT PRO 4G model and the related Service. It does not cover earlier models that work by SMS only, or the Bluetooth channel.

We do not ask you to tick any box for this page. These Rules form part of the Terms and Conditions of Use (/termini), which you accept the first time you sign in: by accepting those, you also accept these. There is no consent to give here, because there is nothing to consent to: there are things to do.

If you administer an Entrance on behalf of others — you are a Customer with several people to authorise, a Distributor or an Installer — also read the Terms for Customers and Administrators (/condizioni-amministratori), which add obligations towards the people you authorise.

1. The six things that matter

If you read only this section, read these six.

1. The phone number is a key. Anyone calling from an Authorised Number opens the Entrance, with no other check at all. If a number should no longer open, it must be revoked on the same day.
2. The Account is personal and is not shared. Anyone who shares their credentials makes it impossible to know who opened, and is responsible for what is done with their Account.
3. A copy of a QR code works just like the QR code. A photograph, a screenshot, a forwarded message: they are all the original. Do not photograph or forward the QR codes you are given.
4. The Device password must be changed on handover. The Device leaves the factory with a default numeric password that is the same for every Device and publicly known.
5. Keep an alternative way of opening the Entrance. The BGates Service is not a security system or an emergency system: it depends on network coverage and on systems that may be unavailable.
6. When something goes wrong, write to info@bgates.it straight away. The first few hours matter more than any explanation given afterwards.

2. Your Account password

2.1 The actual rules

These are the rules. Where a row is written as the Service is designed but is not yet the case on every screen, we tell you so in the row itself, in italics: we do not present to you as in force a rule that the Service does not apply.

Eight characters is a technical minimum, not a recommendation: the Service counts them, and nothing else. An eight-character password that resembles a word can be guessed, and today no check prevents you from using one. What follows is therefore not advice on style: it is the part of the job that remains yours, because the Service does not do it for you.

• a long password that you do not use anywhere else. A four-word phrase you can remember is stronger than eight characters with symbols in place of letters;
• never the same password as for your email, your bank or a service that may already have been caught up in someone else's data breach;
• a password manager, if you use one: it is the simplest way to have different passwords everywhere without having to remember them;
• nobody knows it but you: you do not write it in messages to support, you do not read it out over the phone, and you do not leave it in the Service's description fields or in a device's notes.

Nobody from BGates will ever ask you for your Account password, the six-digit code you receive by email, or the Device password. Anyone who asks you for them is not us. If this happens, do not reply, and write to info@bgates.it.

2.2 Changing it

You change your password from the Private Area, on your profile page. Change it:

• immediately, if you think someone knows it;
• immediately, if you have lost a phone or computer on which your Account was open;
• immediately, if you have also used it elsewhere and that other service has suffered a breach;
• when a person who had it in the past — because the Account was shared, which must not be done — should no longer get in.

There is no need to change it at fixed intervals: changing it every three months leads to worse passwords, not better ones.

2.3 If you have forgotten it

From the sign-in screen, request a reset. You will receive a message at your Account email address, with a link and a six-digit code.

• The code is personal and can be used only once: do not give it to anyone, not even to someone claiming to be support.
• If you receive a reset code that you did not request, someone is trying to get into your Account: do not use it, do not open the link, and write to info@bgates.it.
• The number of reset requests is rate-limited. If you are blocked, wait and try again, or write to support.

2.4 What is not there today, and why we tell you

At present you sign in with a username and password: two-step verification is not available, and the Account is not locked after a set number of failed attempts. There is a rate limit on attempts, applied per network address: it slows down anyone trying to guess, but it is not the same as a lockout.

To open from the web app, however, there is an additional check: the first time from a new device you need a code that we send you by email (§ 2.5). It is not full two-step verification, but a password on its own is no longer enough to open from a device that you have not confirmed yourself.

We tell you this for two reasons. The first is that a security document that claims measures that are not there is worse than no document at all. The second is that it changes what you need to do: as long as the second factor is missing, your password is the only thing protecting the power to open an Entrance, and it must be chosen accordingly.

This is how it is designed, and it is not yet live as of 20 October 2026: two-step verification and locking of the Account after repeated failed attempts. When two-step verification becomes available, turn it on, and turn it on first on every Account that administers an Entrance.

2.5 The device confirmation code

If you open an Entrance from the web app, the first time from a new phone or browser we ask you for a six-digit code that we send you by email. As a rule you can open from only one device: confirming a new one unlinks the previous one, which will have to enter the code again.

• The code is personal: do not give it to anyone, not even to the person who administers the Entrance, to an installer or to someone claiming to be support. No one at BGates will ever ask you for it.
• If you receive a code that you did not request, someone may know your password and be trying to connect another device: do not use it and change your password straight away.
• If you receive the ‘New device connected’ email for a device you do not recognise, change your password straight away: changing it unlinks all the confirmed devices and closes all open sessions, so whoever got in with your password is kept out. Afterwards you will have to confirm your own device again with the code.
• If the code does not reach you, check your spam folder; otherwise ask the person who administers the Entrance to unlock you.

3. No sharing

The Account is personal and non-transferable. It is not lent, not inherited, and not used by two people.

1. One person, one Account. If several people in a business, an apartment building or a family need to administer the same Entrance, an Account is requested for each of them. It does not cost an extra Subscription: it is how the Service is designed.
2. Whoever shares is responsible. Openings made with a shared Account are recorded as made by the person in whose name it is registered: if someone opens when they should not, it is your name in the Opening Log, not theirs.
3. Do not share it even ‘just for a moment’. If a person needs to be able to open, you authorise their number or give them a Single-use QR code: those actions are reversible and traceable; lending your password is not.
4. Credentials are not written down in description fields, in the device's notes, in support messages or in chats. Those texts are kept, and some of them are sent to third-party suppliers: the list is in the Suppliers document (/fornitori).
5. The Accounts of people who have left are deactivated on the day the relationship ends: collaborators, outgoing building managing agents, external technicians.

Sharing credentials is also prohibited by the Acceptable Use Rules (/uso-consentito) and may lead to suspension of the Service.

4. Your devices, and the SIM

The phone and computer you sign in from are as much a part of the Entrance's security as the password.

1. Screen lock always on on the phone you use the BGates app from, with a code, fingerprint or face. An unlocked phone with an open session is a key to the Entrance in the hands of whoever finds it.
2. System updates installed. This applies to your phone, tablet and computer.
3. Sign out of the Private Area when you use a computer that is not yours. If you do not sign out, the session remains valid: in the browser the sign-in is kept for up to 7 days without you having to enter your password again. In the app, the sign-in is stored in the phone's encrypted area (system keychain).
4. Do not install the app from sources other than those we tell you about. The BGates app is opened from the address app.bgates.it and added to your phone's home screen from there: it is not published on the app stores, so a ‘BGates app’ found on an app store is not ours. Report it to us at info@bgates.it.
5. The Device's SIM is managed by BGates and is used only to connect the Device to the Service. It must not be removed, used in a phone or another device, or replaced with a SIM of your own: if you do so, the Device stops being reachable and we can no longer ensure that it works. If the Device needs to be changed, support moves the SIM.
6. If you give away, sell or scrap a phone from which you used the Service, sign out of the Account and remove the app first.

5. The phone number: a key, not a contact detail

This is the part people do not expect, and it is the most important part of the document.

5.1 What really happens to your number

1. It opens by itself. Anyone calling the Entrance from an Authorised Number opens it, on the days and in the time slots set. There is no password, no code, no confirmation.
2. It is written inside the Device. The number does not stay only on our systems: it goes into the On-board Number List of the Device installed at the Customer's premises, so that the Device can recognise you even when there is no network connection.
3. It is recorded every time it is used, with date and time, in the Entrance's Opening Log.
4. It is recorded even if you are not authorised. If you call an Entrance you do not have access to, the Device hangs up immediately and it costs you nothing — but the number has already been read, and the event is recorded. On screen the number is shown masked, and the retention periods are in the Retention Policy (/conservazione).

And one thing that serves as a warning: the calling number is not a strong credential. It is information carried by the telephone network that, under certain conditions, can be spoofed. Anyone who wants stronger protection uses the app with their own Account, where opening goes through personal credentials.

5.2 If you change your number

Changing your number is when almost all problems arise, because nobody thinks about it.

Before you give up your old number:

1. ask the person who administers the Entrance — or do it yourself, if you are the Customer — to authorise the new number;
2. ask for the old one to be revoked, on the same day;
3. check that you can open with the new number, and that you can no longer open with the old one, if you still have it.

If you have several Entrances — home, office, garage, the building's gate — this must be done on all of them. A number revoked on one Entrance remains authorised on the others.

5.3 If you give up your number, and why reassignment is the most real risk

A mobile number that has been given up goes back into circulation and is assigned to another person after a period set by the numbering rules. That person knows nothing about you, your Entrance or your apartment building.

If your old number has remained authorised, the day that person calls that number — by mistake, or because they inherited it in someone's contact list — the gate will open, and the Opening Log will show your name.

That is why:

• anyone giving up a number tells the person who administers the Entrance, and does so beforehand, not afterwards;
• anyone who administers an Entrance sets an expiry date on the numbers they authorise. The Service lets you set an end date: using it is not a convenience, it is a security measure;
• once a year, the list of Authorised Numbers is reviewed and anyone you do not recognise is removed.

5.4 If you lose your phone or it is stolen

Do these things in this order, and on the same day.

If the stolen phone belonged to a person you had authorised, steps 2 and 4 are yours: revoke first, ask for explanations afterwards.

6. How access is revoked, and how long it takes

Summary table. ‘Immediately’ means: the action does not go through support and has no known waiting time.

Revoking a number also takes effect on the Device. Until the Device has received the revocation, the entry remains in the Service to allow reconciliation with the On-board Number List; the period within which the data is then deleted is in the Retention Policy.

After a revocation, check. Make sure the number no longer appears among the Device's Authorised Numbers. If you can still see it after a few hours, write to support: do not wait.

This is how it is designed, and it is not yet live as of 22 September 2026: generation and revocation of an Entrance's QR codes by the Customer, without going through support, and closing all sessions from your own Private Area.

7. QR codes

7.1 Three different things, not to be confused

7.2 The rules

1. Do not photograph or forward a QR code you have been given. A photograph, a screenshot or a forwarded message works just like the original: whoever receives it has in their hands what you have. No technical measure can prevent this, and this document does not promise otherwise.
2. A Single-use QR code is personal. It is used once only and is then no longer valid. A record remains of who used it and when. It does not expire after a set time: it remains valid until it is used or revoked. If the person does not use it, it must be revoked.
3. Do not publish a QR code in a group chat, on social media, in a rental advertisement or on a sign outside the property. A published QR code is public for ever, even after you have deleted the message.
4. Do not photograph the Device label or publish images of it: it contains the activation code and the Device's technical data.
5. If you receive a QR code you were not expecting, do not use it, and ask for confirmation from the person who says they sent it to you, on a channel other than the one you received it on.
6. Display the Permanent QR code where it makes sense: at the Entrance it relates to, not on an open street or at a spot reachable by people who have nothing to do with that access.

7.3 If a QR code has been copied, photographed or forwarded

It is not an emergency if you act straight away. In order:

1. Ask BGates support to revoke the QR code, saying which Entrance and which QR code it is. If it is a Single-use QR code that has not yet been used, revocation settles the matter.
2. Have the Permanent QR code regenerated if it is the one displayed at the Entrance: the old code stops working and the new one is printed.
3. Look at the access requests received from that QR code in the preceding days, and reject any you do not recognise. Remember that the number given in a request is self-declared and not verified: anyone can enter someone else's number.
4. Check the Opening Log of the Entrance for the period concerned.
5. If someone has got in without being entitled to, write to info@bgates.it: if it is a personal data breach, the time limits in the Breach and Incident Management document (/incidenti) apply.

7.4 Who is responsible for what

BGates is responsible for randomness, revocability, single use, recording of use and what the code reveals — and, where an expiry is stated, for compliance with it. The Customer is responsible for where the QR code is displayed, whom it is given to and how long they wait before revoking it.

This is how it is designed, and it is not yet live as of 22 September 2026: expiry, single use and revocability of the Activation QR code printed on the label, and recording of its use. Until then, the code on the label must be treated as a credential: the Device is kept in a place not accessible to outsiders, and the label is not photographed.

8. The Device password

8.1 Changing it on handover is not a suggestion

The Device leaves the factory with a default numeric password, the same for every Device and publicly known: it is given in the manual. Anyone who knows it and can reach the Device — by SMS or via Bluetooth, standing near it — can read and change its configuration and its On-board Number List, that is the list of numbers that open.

Therefore:

1. the password is changed when the installation is handed over, before the Device goes into service. This is an obligation of the Customer and of whoever hands over the installation, and it is also set out in the Terms for Customers and Administrators;
2. do not choose an obvious sequence: not 0000, not 1234, not the current year, not the house number;
3. do not leave it written down in the handover documents, in the test report, in a chat or on a label stuck to the Device;
4. change it again after every intervention in which an external technician has learnt it, and after every factory reset, because a reset returns it to the default;
5. be careful: resetting the settings does not delete the numbers from the On-board Number List. To empty it, a full deletion is needed (§ 10).

8.2 What this password does not do

The Device does not block repeated attempts. There is no maximum number of attempts and no increasing delay: a four-digit password, for someone who has time and is within range, is not a strong barrier.

We state this because two practical consequences follow from it: keep an alternative means of access to the Entrance (key, remote control, manual opening), and do not use the BGates Service as the sole security safeguard for a place. The Service controls an automation system; it does not watch over it and does not replace its safety devices.

8.3 Messages that should make you suspicious

Report to info@bgates.it straight away if:

• you receive a message containing the Device password without having asked for it;
• the installation's notification number receives an alert of an attempt with a wrong password that you do not recognise;
• the Device responds to commands that nobody sent, or changes its configuration by itself;
• numbers that nobody authorised appear in the On-board Number List, or numbers that were there disappear.

This is how it is designed, and it is not yet live as of 22 September 2026: the requirement to change the password at first switch-on as a blocking step of the commissioning test, and removal of the default password from the manual. Until then, changing it remains an obligation of whoever hands over the installation, and this document does not state that the Device enforces it.

9. If you administer an Entrance: least privilege

This applies to the Customer who manages access, to the Distributor and to the Installer. The full rules are in /condizioni-amministratori; the security rules are here.

1. One Account per person, never one shared between colleagues or between building managing agents.
2. The lowest role that allows the work to be done. Someone who only needs to open should not be able to authorise numbers; someone who needs to manage one installation should not see other people's installations. If someone has more powers than they need, ask for them to be reduced.
3. An up-to-date list of who has access. Review it at least once a year and every time someone leaves their role: Accounts, Authorised Numbers and QR codes handed out.
4. Deactivate the Accounts of people who no longer work for you, on the same day.
5. When two-step verification becomes available, turn it on for all Accounts that administer an Entrance, starting with your own.
6. Exporting the Opening Log takes the data outside the Service. A downloaded file contains who opened and when: look after it as you would look after an attendance list, do not send it in a chat, and delete it when it is no longer needed. You are responsible for where that file ends up.
7. Printed material is a copy that leaves the system: leaflets with QR codes, passes, labels. It must be kept safe and destroyed when no longer needed.
8. Do not use the Opening Log to keep watch on people. If the Entrance gives access to a workplace, there are specific obligations before you can consult it: they are in the Terms for Customers and Administrators.

10. When the Device changes hands

If you sell the Device, transfer the property, change the installation's manager or decommission it, other people's numbers must not remain on board. The procedure is as follows:

1. revoke all Authorised Numbers from the Private Area;
2. ask BGates support for full deletion of the configuration and of the On-board Number List of the Device, and for confirmation that the On-board Number List is empty. A settings reset alone is not enough: it does not delete the numbers;
3. change the Device password and give it only to the person taking over, if the Device stays in service;
4. ask for the Entrance's history to be deleted by writing to info@bgates.it, stating the Device serial number and the date of the handover;
5. get written confirmation that the operations have been carried out: you will need it if someone disputes an opening that took place after the handover.

This is how it is designed, and it is not yet live as of 22 September 2026: the decommissioning procedure presented in the Private Area as a guided sequence, with a record of the operations carried out. Until then, it is carried out with support.

11. Compromised Account

11.1 The signs

• accesses or openings in the Opening Log that you did not make and that nobody you know made;
• notifications of access requests, Invites or QR codes that nobody generated;
• the message ‘password changed’ or a reset code you did not request;
• authorised numbers you do not recognise on one of your Entrances;
• being unable to sign in with a password you know is correct.

11.2 What you do, in this order

1. Change the password of the Account, from a device you trust. If you cannot get in, go straight to point 3.
2. Change the password of the email account linked to the Account: whoever controls the email can request a reset.
3. Write to info@bgates.it, stating: your username, what you noticed, since when, and on which Entrances. Ask for all sessions to be closed and, if necessary, for the Account to be suspended.
4. If you are the Customer of an Entrance, review the Authorised Numbers straight away and revoke any you do not recognise; then review the Opening Log for the period.
5. Do not delete suspicious messages and notifications: they are needed to reconstruct what happened.

11.3 What we do

When you report a compromise to us: we suspend the Account if you ask us to, we close the sessions, we tell you what our technical logs show and, if a personal data breach emerges, we apply the procedure in the Breach and Incident Management document (/incidenti): we notify the Garante per la protezione dei dati personali (Italian Data Protection Authority) within 72 hours of becoming aware of it (Article 33 GDPR) and, if the breach is likely to result in a high risk to your rights, we also tell you (Article 34 GDPR). If the Entrance involved is administered by a Customer, we inform the Customer within 24 hours of becoming aware of it, so that they can decide in time.

If the incident concerns the security of the Device or the software, we also tell you what you need to do and which update to install.

12. Reporting a security problem

Write to info@bgates.it. This applies to anyone: customers, users, installers, and also people who have no relationship with us and have noticed something.

What to write, in the order we need in order to understand quickly:

What not to write: passwords, six-digit codes, QR code contents. We do not need them, and an email message is not the place to keep them.

The time limits.

If you are looking for vulnerabilities, these are the conditions for doing so in good faith: do not test on installations that are not yours, do not access other people's data, do not degrade the Service, do not alter or delete anything, stop as soon as you have proof that the problem exists, and do not make it public before it has been fixed or before we have discussed it. Anything outside these conditions falls under the Acceptable Use Rules (/uso-consentito).

13. What we do, and what we do not promise

What is in operation today. Pages and apps travel over encrypted connections. Passwords are stored in encrypted, non-reversible form. Login attempts are rate-limited. The server is protected by a traffic filter and by a system that blocks addresses that persist. Backups are encrypted. Each role sees only the part of the data it is entitled to.

What is not yet as we would like it to be, and what we are closing. The connection between the Device and our systems is not encrypted on all installed Devices: migration to the encrypted channel is in progress. Backups are stored on the same machine that hosts the Service. Two-step verification is not available.

What we do not say, and what no BGates document will ever say: that security is absolute, total, guaranteed or one hundred per cent. It is not, for anyone.

What depends on you: the twelve sections above.

14. Where to find the rest

Version 2026.10.20-1 — in effect from 20 October 2026. When we change something substantial — a new purpose, a new supplier, a longer retention period — we publish the new version here, with its date, and if you have an Account we tell you by email. This document is not accepted: it is read, and we do not ask you to tick any box. Corrections of form do not change the version. Previous versions are available on request from info@bgates.it.