Gid trust center
Compliance, stated precisely.
The legal mechanisms and control practices we use today, without presenting a framework, cloud provider, or product feature as a certification.
Current assurance status: Gid has not completed its own SOC 2 examination and does not hold an ISO/IEC 27001 certificate.
Reviewed July 23, 2026
There is no Gid SOC 2 report or Gid ISO/IEC 27001 certificate to provide.
Relevant practices guide engineering and operations, but that is not an attestation.
Applicable duties depend on the data, role, use case, contract, and jurisdiction.
1. How to read this page
Privacy laws such as GDPR, CCPA/CPRA, PIPEDA, and Quebec Law 25 are legal regimes, not commercial certifications. Whether a particular obligation applies depends on Gid's role, the customer's use of the service, the people involved, and the jurisdiction. This page is a factual posture summary, not legal advice or a blanket legal attestation.
2. Assurance map
| Framework or law | Gid status | What that means |
|---|---|---|
| SOC 2 | No Gid report | Trust Services Criteria inform parts of our control program. Gid has not completed a Type I or Type II examination. |
| ISO/IEC 27001 | Not certified | Relevant information-security practices are references. Gid has not been certified by an accredited certification body. |
| ISO/IEC 27018 | No Gid certificate | Some Firebase services are listed by Google within provider certification scope. That scope does not transfer to Gid. |
| PCI DSS | No direct Gid certification claim | Stripe-hosted Checkout handles card entry. Stripe is a PCI Level 1 service provider; using Stripe reduces Gid's scope but does not automatically certify Gid. |
| Privacy laws | Context-dependent duties | Gid publishes contractual and operational mechanisms intended to address applicable privacy obligations. Laws are not certification schemes. |
3. Mechanisms available today
Privacy terms and processing contract
Our Privacy Policy describes data practices, and our Data Processing Agreement sets processor commitments where it applies.
Vendor transparency
The Sub-processors page identifies the services used for hosting, AI, communications, billing, and operations.
Data rights
Users can request an account deletion at /delete-account. Data-access instructions are published at /data-export.
Security reporting
Security and abuse concerns use one monitored address: security@gidai.ca. Privacy requests use privacy@gidai.ca.
4. Product support is not customer certification
Gid can help hospitality teams record training, schedules, acknowledgements, and operational activity. Those features do not certify an employee, a workplace, a food-safety program, payroll calculations, or a restaurant's compliance with labor, health, alcohol-service, tax, or other laws.
Customers remain responsible for choosing lawful settings, assigning qualified reviewers, validating local requirements, and keeping their own policies and records current. Removing Gid from a workflow must not remove the customer's independent legal judgment.
5. Evidence and requests
We can provide our published policies, DPA, Sub-processor list, and reasonable answers about implemented controls. We cannot provide a Gid SOC 2 report or Gid ISO certificate because neither exists today.