{"@context":"https://certreports.com/llms.txt","vendor":{"slug":"gigs","name":"Gigs","domain":"gigs.com","category":"HR and HRIS","one_liner":"The OS for Embedded Telecom","trust_center_url":"https://trust.gigs.com/","security_page_url":null,"url":"https://certreports.com/vendors/gigs/security","last_verified_at":"2026-11-03T00:00:00.000Z","claimed":false,"verified_profile":false},"attestations":[{"framework":"soc-2","framework_name":"SOC 2","state":"verified_auditor","state_label":"Verified","sentence":"Confirmed by the public SOC 3 report for the period ending 14 Jan 2026, as of 3 Nov 2026.","kind":"type2","status_text":"Evidenced by the public SOC 3 report for the same examination period","issued_at":"2026-03-11","expires_at":null,"period_start":"2025-01-15","period_end":"2026-01-14","auditor":null,"impact_level":null,"as_of":"2026-11-03","under_review":false,"source":"soc3","url":"https://certreports.com/vendors/gigs/soc-2","evidence":[{"source_type":"auditor","source_name":"Gigs SOC 3 report (trust.gigs.com)","url":"https://trust.gigs.com/doc/trust?rid=69b2f716b011cc4405d8b223&r=bob2tvhrrxl34kujt8gph&view=true","fetched_at":"2026-10-26 02:01:03.020216+00","content_hash":"3e224eb6aa561573294a8511b4ab851396335b0db395db71f44f555ffbb5f9ad","wayback_url":null,"quote":"In our opinion, management's assertion that the controls within Gigs, Inc. 's Gigs Platform were effective throughout the period January 15, 2025 to January 14, 2026, to provide reasonable assurance that Gigs, Inc. service commitments and system requirements were achieved based on the applicable trust services criteria is fairly stated, in all material respects.","confidence":0.9}]},{"framework":"gdpr","framework_name":"GDPR","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states a data processing agreement on its trust centre (Vanta) as of 21 Sep 2026.","kind":null,"status_text":"Vendor states GDPR on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-21","under_review":false,"source":"vanta","url":"https://certreports.com/vendors/gigs/gdpr","evidence":[{"source_type":"trust_center","source_name":"Gigs trust centre (Vanta)","url":"https://trust.gigs.com/","fetched_at":"2026-09-21 22:39:43.454515+00","content_hash":"f2600d5a1435c86cf725a6cbea7ea2d583a860b70c351c3d1872d9c777ad0f7d","wayback_url":null,"quote":"GDPR","confidence":1},{"source_type":"trust_center","source_name":"Gigs trust centre (Vanta)","url":"https://trust.gigs.com/","fetched_at":"2026-09-18 23:19:02.743566+00","content_hash":"e636aacae646c2d372d5c86ba9660c9736b0e16f252d770d2cef7b1637f97e30","wayback_url":null,"quote":"GDPR","confidence":1}]},{"framework":"pci-dss","framework_name":"PCI DSS","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states a PCI DSS attestation of compliance on its trust centre (Vanta) as of 21 Sep 2026.","kind":null,"status_text":"Vendor states PCI DSS - SAQ A on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-21","under_review":false,"source":"vanta","url":"https://certreports.com/vendors/gigs/pci-dss","evidence":[{"source_type":"trust_center","source_name":"Gigs trust centre (Vanta)","url":"https://trust.gigs.com/","fetched_at":"2026-09-21 22:39:43.454515+00","content_hash":"f2600d5a1435c86cf725a6cbea7ea2d583a860b70c351c3d1872d9c777ad0f7d","wayback_url":null,"quote":"PCI DSS - SAQ A","confidence":1},{"source_type":"trust_center","source_name":"Gigs trust centre (Vanta)","url":"https://trust.gigs.com/","fetched_at":"2026-09-18 23:19:02.743566+00","content_hash":"e636aacae646c2d372d5c86ba9660c9736b0e16f252d770d2cef7b1637f97e30","wayback_url":null,"quote":"PCI DSS - SAQ A","confidence":1}]},{"framework":"soc-3","framework_name":"SOC 3","state":"verified_auditor","state_label":"Verified","sentence":"Confirmed by the public SOC 3 report for the period ending 14 Jan 2026, as of 3 Nov 2026.","kind":"type2","status_text":"Public SOC 3 report on the vendor's trust centre","issued_at":"2026-03-11","expires_at":null,"period_start":"2025-01-15","period_end":"2026-01-14","auditor":null,"impact_level":null,"as_of":"2026-11-03","under_review":false,"source":"soc3","url":"https://certreports.com/vendors/gigs/security","evidence":[{"source_type":"auditor","source_name":"Gigs SOC 3 report (trust.gigs.com)","url":"https://trust.gigs.com/doc/trust?rid=69b2f716b011cc4405d8b223&r=bob2tvhrrxl34kujt8gph&view=true","fetched_at":"2026-10-26 02:01:03.020216+00","content_hash":"3e224eb6aa561573294a8511b4ab851396335b0db395db71f44f555ffbb5f9ad","wayback_url":null,"quote":"In our opinion, management's assertion that the controls within Gigs, Inc. 's Gigs Platform were effective throughout the period January 15, 2025 to January 14, 2026, to provide reasonable assurance that Gigs, Inc. service commitments and system requirements were achieved based on the applicable trust services criteria is fairly stated, in all material respects.","confidence":0.95}]},{"framework":"ccpa","framework_name":"CCPA / CPRA","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states an CCPA / CPRA privacy notice on its trust centre (Vanta) as of 21 Sep 2026.","kind":null,"status_text":"Vendor states CCPA on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-21","under_review":false,"source":"vanta","url":"https://certreports.com/vendors/gigs/security","evidence":[{"source_type":"trust_center","source_name":"Gigs trust centre (Vanta)","url":"https://trust.gigs.com/","fetched_at":"2026-09-21 22:39:43.454515+00","content_hash":"f2600d5a1435c86cf725a6cbea7ea2d583a860b70c351c3d1872d9c777ad0f7d","wayback_url":null,"quote":"CCPA","confidence":1},{"source_type":"trust_center","source_name":"Gigs trust centre (Vanta)","url":"https://trust.gigs.com/","fetched_at":"2026-09-18 23:19:02.743566+00","content_hash":"e636aacae646c2d372d5c86ba9660c9736b0e16f252d770d2cef7b1637f97e30","wayback_url":null,"quote":"CCPA","confidence":1}]}],"brief":null,"legal_docs":[{"kind":"privacy","url":"https://gigs.com/legal/privacy-policy","availability":"public","detail":null,"as_of":"2026-09-21"},{"kind":"security_txt","url":"https://trust.gigs.com/","availability":"public","detail":"Public documents on the trust centre: Gigs SOC 3 Report","as_of":"2026-09-18"},{"kind":"subprocessors","url":"https://trust.gigs.com/","availability":"public","detail":"17 subprocessors listed on the trust centre","as_of":"2026-09-21"}],"documents":[{"type":"architecture_diagram","title":"Gigs Architecture and Systems Diagram","availability":"on_request","source_url":"https://trust.gigs.com/","last_seen":"2026-09-21"},{"type":"business_continuity","title":"Business Continuity and Disaster Recovery Plan","availability":"on_request","source_url":"https://trust.gigs.com/","last_seen":"2026-09-21"},{"type":"business_continuity","title":"Disaster Recovery Test Results","availability":"on_request","source_url":"https://trust.gigs.com/","last_seen":"2026-09-21"},{"type":"incident_response","title":"Incident Response Plan (Availability)","availability":"on_request","source_url":"https://trust.gigs.com/","last_seen":"2026-09-21"},{"type":"incident_response","title":"Incident Response Plan (Security)","availability":"on_request","source_url":"https://trust.gigs.com/","last_seen":"2026-09-21"},{"type":"insurance","title":"Cyber Insurance COI 2026/2027","availability":"on_request","source_url":"https://trust.gigs.com/","last_seen":"2026-09-21"},{"type":"pci_aoc","title":"PCI DSS 4.0.1. SAQ A and AoC","availability":"on_request","source_url":"https://trust.gigs.com/","last_seen":"2026-09-21"},{"type":"pentest_report","title":"Application Penetration Test 2026 - Retesting Report","availability":"on_request","source_url":"https://trust.gigs.com/","last_seen":"2026-09-21"},{"type":"pentest_report","title":"Application Penetration Test 2026 - Security Audit Summary","availability":"on_request","source_url":"https://trust.gigs.com/","last_seen":"2026-09-21"},{"type":"soc2_report","title":"Gigs SOC 2 Type II Report","availability":"on_request","source_url":"https://trust.gigs.com/","last_seen":"2026-09-21"},{"type":"soc3_report","title":"Gigs SOC 3 Report","availability":"public","source_url":"https://trust.gigs.com/","last_seen":"2026-09-21"}],"statements":[{"topic":"data_location","question":"Where are your servers located?","answer":"Gigs operates exclusively on Google Cloud (GPC) with data residency in EU regions. For subprocessors please refer to https://trust.gigs.com/subprocessors","value":null,"regions":["EU"],"source_url":"https://trust.gigs.com/faq?s=8w5osyv6qw4qx07amalds","as_of":"2026-09-21"},{"topic":"encryption","question":"Do you encrypt data at rest?","answer":"Yes, data is stored in encrypted Cloud SQL instances and encrypted Google Cloud Storage Buckets using AES-256.","value":null,"regions":[],"source_url":"https://trust.gigs.com/faq?s=16s36r1ayjcewpi4tjuymh","as_of":"2026-09-21"},{"topic":"encryption","question":"How does Gigs encrypt data in-transit?","answer":"Gigs uses TLS 1.2 or higher for data transmissions over potentially insecure networks. We also use features such as HSTS (HTTP Stric Transport Security). TLS keys and certificates are managed by Google Cloud.","value":null,"regions":[],"source_url":"https://trust.gigs.com/faq?s=5bvc4vldhq9alukwuy35x4","as_of":"2026-09-21"},{"topic":"penetration_testing","question":"Does Gigs perform Penetration Tests?","answer":"Yes, we perform Penetration Tests through external parties at least annually. Scopes may include Web Application Security, Telecom-specific Security and Infrastructure Security.","value":null,"regions":[],"source_url":"https://trust.gigs.com/faq?s=h572w3m79s0uximatr33ck","as_of":"2026-09-21"}],"security_profile":{"iso42001":null,"trains_on_customer_data":null,"data_residency_regions":["EU"],"pen_test_cadence":"annual","as_of":"2026-09-21"},"regulations_url":"https://certreports.com/api/v1/vendors/gigs/regulations/{regulation}","subprocessors":[{"name":"Airtable","domain":"airtable.com","purpose":"Business data","location":"USA","vendor_url":"https://certreports.com/vendors/airtable/security"},{"name":"Fivetran","domain":"fivetran.com","purpose":"Data processing","location":"USA","vendor_url":"https://certreports.com/vendors/fivetran/security"},{"name":"Google Cloud Platform","domain":"google.com","purpose":"Cloud provider","location":"EU","vendor_url":"https://certreports.com/vendors/google/security"},{"name":"Google Workspace","domain":"google.com","purpose":"Productivity","location":"USA and EU","vendor_url":"https://certreports.com/vendors/google/security"},{"name":"HireHoratio","domain":"hirehoratio.com","purpose":"BPO support for North America & LATAM customers","location":"Americas","vendor_url":null},{"name":"HubSpot","domain":"hubspot.com","purpose":"Customer Relationship Management","location":"USA","vendor_url":"https://certreports.com/vendors/hubspot/security"},{"name":"Linear","domain":"linear.app","purpose":"Productivity","location":"USA","vendor_url":"https://certreports.com/vendors/linear/security"},{"name":"Notion","domain":"notion.com","purpose":"Collaboration","location":"USA","vendor_url":null},{"name":"Otonomee","domain":"otonomee.com","purpose":"BPO support for global customers","location":"EU","vendor_url":null},{"name":"PostHog","domain":"posthog.com","purpose":"Product data analytics","location":"EU","vendor_url":"https://certreports.com/vendors/posthog/security"},{"name":"Pylon","domain":"usepylon.com","purpose":"Customer support portal","location":"USA","vendor_url":"https://certreports.com/vendors/pylon-usepylon/security"},{"name":"Sendgrid","domain":"sendgrid.com","purpose":"Transactional Emails","location":"USA","vendor_url":"https://certreports.com/vendors/sendgrid/security"},{"name":"Sentry","domain":"sentry.io","purpose":"Cloud monitoring","location":"USA","vendor_url":"https://certreports.com/vendors/sentry/security"},{"name":"Slack","domain":"slack.com","purpose":"Productivity","location":"USA","vendor_url":"https://certreports.com/vendors/slack-technologies/security"},{"name":"Stripe","domain":"stripe.com","purpose":"Payments processing","location":"USA","vendor_url":"https://certreports.com/vendors/stripe/security"},{"name":"Svix","domain":"svix.com","purpose":"Webhook management","location":"EU","vendor_url":"https://certreports.com/vendors/svix/security"},{"name":"WorkOS","domain":"workos.com","purpose":"Enterprise SSO on Dashboard and Gigs For Work","location":"USA","vendor_url":null}],"disclaimer":"CertReports indexes public evidence. A missing framework means no public evidence was found at the last check, not that the vendor is non-compliant. SOC 2 is a report, not a certification; HIPAA has no certification.","generated_at":"2026-11-03T18:56:12.708Z"}