Compliance
What is verified — and what is not
A compliance page that lists badges nobody can check is worse than none. DineGlobe has not obtained a third-party audit or certification yet; below is what the system actually does, enforced by its own tests, and the gaps we are deliberately honest about.
Practices in place today
- Purpose-limited data: guest notes exist for service only, encrypted at rest, audited on read
- Export and erasure workflows that venues run for their guests, with tombstoned deletion ledgers
- Retention schedules a venue configures, executed and evidenced by the system
- Server-side tenant isolation proven by cross-tenant tests, not policy documents
- Append-only evidence surfaces: audit events, payment ledgers, backup records, deployment records
- Documented backups with scheduled restore drills — the restore is the proof
- Signed launch-readiness reviews before any market capability activates
Not yet — and stated as such
- No third-party audit or certification (SOC 2, ISO 27001 or similar) has been obtained
- No formal GDPR Article 30 records of processing or DPIA have been completed
- The deployment is a single server with no high-availability arrangement
- Off-server backup storage is not yet mounted — backup-age monitoring reports this openly
- No data protection officer is appointed
When a certification is earned it will be listed here with its scope and date — not before. If your evaluation needs any of the items above sooner, tell us; pilot-stage flexibility is the one advantage of a young company.