How GAT ensures it is GDPR compliant
Given its access to all aspects of your G Suite environment, the GAT Suite must themselves respect the GDPR environment for your data.
GAT does this in several ways. The only data it collects and stores is your user metadata. This consists of username, company email address, access times, email addresses to and from the user account, email metadata, Google + postings with the domain account, files owned, calendars and appointments in the company domain and other non-specific usage data (such as membership of email groups, OUs, etc.).