Gid trust center
Security, without borrowed badges.
What protects hospitality teams today, what our providers cover, and where Gid's own assurance program actually stands.
Current assurance status: Gid is not currently SOC 2 audited or ISO/IEC 27001 certified. We use relevant practices from those frameworks as engineering references.
Reviewed July 23, 2026
No Gid SOC 2 report or Gid ISO/IEC 27001 certificate is available.
SOC 2 and ISO control themes help guide risk, access, change, and incident practices.
Google Cloud and Firebase reports apply only to the provider services in their stated scope.
1. The assurance boundary
When Gid completes a direct independent audit or certification, this page will name the exact standard, scope, auditor, report or certificate period, and any exclusions. Until then, we will not display a Gid certification badge.
2. Controls in place today
Identity and access
Gid uses Firebase Authentication. Authorization is enforced through server checks and Firestore Security Rules designed around user, role, tenant, and location scope where applicable. The client interface is not treated as a security boundary.
Data protection
Web and API traffic uses TLS. Hosted data relies on encryption controls supplied by the applicable Google Cloud service. The exact provider control depends on the service and configuration in use.
Secrets and payments
Server credentials are supplied through managed secret configuration rather than embedded in public page code. Card entry uses Stripe-hosted Checkout; Stripe's PCI status is not presented as a Gid certification.
Monitoring and reporting
Cloud Logging and Error Reporting support operational visibility. Reports sent to security@gidai.ca enter our security-response path. Gid does not claim a continuously staffed security operations center.
Security-sensitive changes
Access-control, tenant-isolation, backend, and client changes are reviewed and tested in their own enforcement layers. A successful client-side check is never treated as proof of server authorization.
Data rights
Public account-deletion and data-access paths use email confirmation so a requester can act without reinstalling the app while reducing account-enumeration and unauthorized-deletion risk.
4. Provider evidence
These primary sources substantiate provider claims only. They are linked so customers can inspect the boundary rather than rely on a logo.
5. Report a vulnerability or incident
Email security@gidai.ca. Include the affected URL or feature, the impact you observed, and reproducible steps when safe. Please do not include passwords, live access tokens, unnecessary personal data, or data belonging to another customer.
We do not advertise a paid bug bounty today. Good-faith research and prohibited testing are described in our Acceptable Use Policy.