Gigs
Security and trust center evidence
The OS for Embedded Telecom
Summary
Gigs has 2 registry-verified rows and 3 vendor-stated rows in the CertReports index, last verified 2 Nov 2026. The strongest row is SOC 2: Evidenced by the public SOC 3 report for the same examination period. This page is independent of the vendor’s own trust centre: dates, sources and caveats come from CertReports captures.
Reviewer brief
As of 2 Nov 2026, CertReports holds 2 registry-verified rows and 3 vendor-stated rows for Gigs, drawn from soc3 and its trust centre (Vanta). Gigs publishes a SOC 3 report in which an independent service auditor found its controls effective against the trust services criteria for the period 15 Jan 2025 to 14 Jan 2026, the examination a SOC 2 Type II report covers. Gigs states on its trust centre that it holds a data processing agreement, a PCI DSS attestation of compliance and an CCPA / CPRA privacy notice, captured 21 Sep 2026; these are vendor statements, not independent confirmations. No public evidence was found for ISO/IEC 27001, HIPAA and FedRAMP as of 2 Nov 2026; that is a gap in the public record, not a finding of non-coverage, and the vendor can supply it under NDA.
- SOC 2: Evidenced by the public SOC 3 report for the same examination period, verified as of 2 Nov 2026
- SOC 3: Public SOC 3 report on the vendor's trust centre, verified as of 2 Nov 2026
- GDPR: Vendor states GDPR on its trust centre, vendor-stated as of 21 Sep 2026
Facts only, each dated; nothing here is inferred, scored or advised.
Among hr and hris vendors
2verified rows
Category median 0, across 94 indexed hr and hris vendors. Gigs has more verified rows than 91 percent of them.
embedded telecomesimmobile connectivitymvnotelecom api
Compliance grid
SOC 2VerifiedEvidenced by the public SOC 3 report for the same examination period
as of 2 Nov 20261 source
GDPRVendor-statedVendor states GDPR on its trust centre
as of 21 Sep 20262 sources
PCI DSSVendor-statedVendor states PCI DSS - SAQ A on its trust centre
as of 21 Sep 20262 sources- SOC 3Verified
Public SOC 3 report on the vendor's trust centre
as of 2 Nov 20261 source 
CCPA / CPRAVendor-statedVendor states CCPA on its trust centre
as of 21 Sep 20262 sources
Legal artefacts
Subprocessors (17)
AirtableBusiness data · USA
FivetranData processing · USA
Google Cloud PlatformCloud provider · EU- Google WorkspaceProductivity · USA and EU
- HIHireHoratioBPO support for North America & LATAM customers · Americas
HubSpotCustomer Relationship Management · USA
LinearProductivity · USA- NONotionCollaboration · USA
- OTOtonomeeBPO support for global customers · EU
PostHogProduct data analytics · EU- PYPylonCustomer support portal · USA
SendgridTransactional Emails · USA
SentryCloud monitoring · USA
SlackProductivity · USA
StripePayments processing · USA- SVSvixWebhook management · EU
- WOWorkOSEnterprise SSO on Dashboard and Gigs For Work · USA
Security profile
- Pen test cadence
- annual
- Data residency
- EU
Displayed as a security profile from public statements, not as attestations, as of 21 Sep 2026.
Change history
- 25 Sep 2026SOC 2 state changedState moved from Vendor-stated to Verified.
- 25 Sep 2026SOC 3 evidence addedA SOC 3 row entered the index with state Verified.
- 18 Sep 2026First indexed by CertReports4 evidence rows across 4 frameworks entered the index.
Evidence against regulations
All regulations for GigsHow much of each regulation’s vendor requirements Gigs’s public evidence reaches.
Reviewing a vendor on public evidence
All articlesWhat Is Third-Party Risk Management (TPRM)? A Practical Guide
Solomon Amos · 2 Nov 2026 · 10 min read
What Is a Trust Centre? Vendor Evidence vs Office Settings
Solomon Amos · 28 Oct 2026 · 10 min read