Trust Centre › 10. Compliance and certificates
Compliance and certificates
In short
DIANO itself does not hold ISO 27001, SOC 2 or any other security certificate. Google's certificates cover Google's part, not DIANO's own work. DIANO runs on Google Cloud. For the services DIANO uses (the database, sign-in, server functions and file storage), Google holds ISO/IEC 27001, 27017 and 27018 certificates and SOC 1, SOC 2 and SOC 3 reports. Firebase Hosting holds ISO/IEC 27001 and SOC 1, 2 and 3.
What Google Cloud holds
- DIANO runs on Google Cloud. For the services DIANO uses (the database, sign-in, server functions and file storage), Google holds ISO/IEC 27001, 27017 and 27018 certificates and SOC 1, SOC 2 and SOC 3 reports. Firebase Hosting holds ISO/IEC 27001 and SOC 1, 2 and 3.
See Google Cloud's list of certificates and reports and Firebase's privacy and security page, with its certificates per service and where each service runs.
POPIA
- There is no official POPIA certificate for any cloud service, so DIANO does not claim one.
- For the records you keep in DIANO, your business is the responsible party and DIALE Consulting is the operator.
- DIALE Consulting's Information Officer is Jonathan Diale (Director). Contact: info@diale.co.za, 087 265 3889.
Google's page about the POPI Act: Google Cloud's POPI Act page.
What DIANO does
- DIANO's policies are published: privacy, terms, refunds and cancellation. Sign-up asks you to accept them.
- Releases go through a deploy guard: a tool that builds from a recorded version, runs the checks first and stops if anything differs from what was reviewed.
- Nobody can edit or delete entries in the audit trail. Only DIANO's server writes them.
What DIANO does not hold yet
- DIANO itself does not hold ISO 27001, SOC 2 or any other security certificate. Google's certificates cover Google's part, not DIANO's own work.
- No outside firm has tested DIANO's security yet (a penetration test).
Roadmap: planned, not true yet
- Planned — target March 2027: An outside firm tests DIANO's security, and a summary letter is published here.
- Planned — target November 2026: The Operator Agreement is reviewed by a lawyer and offered to every company.
Targets can move. When an item is done, it moves up into the page with its proof. The whole roadmap.
For your IT team / auditor
Each statement on this page, how it was checked and when. Every check was read-only. The full evidence (commands and their output) is available to auditors on request.
| Statement | How it was checked | Checked |
|---|---|---|
| DIANO itself does not hold ISO 27001, SOC 2 or any other security certificate. Google's certificates cover Google's part, not DIANO's own work. | no certificate held (Jonathan to confirm in review, this build's report); DIANO's market scan (gap table). | 2026-10-19 |
| DIANO runs on Google Cloud. For the services DIANO uses (the database, sign-in, server functions and file storage), Google holds ISO/IEC 27001, 27017 and 27018 certificates and SOC 1, SOC 2 and SOC 3 reports. Firebase Hosting holds ISO/IEC 27001 and SOC 1, 2 and 3. | Firebase privacy page table; Google compliance offerings (published sources (see Sources)). | 2026-10-19 |
| There is no official POPIA certificate for any cloud service, so DIANO does not claim one. | Google's POPI page offers contractual support, not a certification; the /security/compliance/popia address returns 404 (published sources (see Sources)). | 2026-10-19 |
| For the records you keep in DIANO, your business is the responsible party and DIALE Consulting is the operator. | DIANO's published pages (clause 3). | 2026-10-19 |
| DIALE Consulting's Information Officer is Jonathan Diale (Director). Contact: info@diale.co.za, 087 265 3889. | DIANO's published pages (clause 1); confirmed by Jonathan on 19 Oct 2026 (DIANO's records). | 2026-10-19 |
| DIANO's policies are published: privacy, terms, refunds and cancellation. Sign-up asks you to accept them. | DIANO's published pages; DIANO's published pages (sign-up checkbox: "I have read and accept the Terms and Conditions, …"). | 2026-10-19 |
| Releases go through a deploy guard: a tool that builds from a recorded version, runs the checks first and stops if anything differs from what was reviewed. | DIANO's deploy tools; DIANO's release checklist. | 2026-10-19 |
| Nobody can edit or delete entries in the audit trail. Only DIANO's server writes them. | DIANO's live database rules (companies/{id}/auditLog: allow write: if false). | 2026-10-19 |
| No outside firm has tested DIANO's security yet (a penetration test). | no penetration-test report in the repository or the run reports (19 Oct 2026); Jonathan to confirm (this build's report, decisions). | 2026-10-19 |