A summary of how we protect customer data, stated plainly, including what we have not finished. The documents behind it are available on request.
Last verified against our product: October 4, 2026
Compliance posture
Item
Status
SOC 2 report
We do not hold a SOC 2 report. A SOC 2 programme is planned; control documentation and tooling groundwork are in progress. No audit has started. Scale and Enterprise customers receive the report under NDA once issued.
ISO 27001 certification
Not held.
Independent penetration test
Not yet completed; planned.
Vendor security reviews
In progress. We are collecting a signed DPA and current SOC 2 or equivalent report from each subprocessor, and will tell you exactly where any vendor stands on request.
Data Processing Addendum
Available. Includes EU Standard Contractual Clauses and a 72-hour breach notice.
Uptime SLA
None published. We do not yet run automated uptime and error-rate monitoring.
If a certification or test is a hard requirement for your purchase, tell us. It helps us sequence the work.
Controls in place today
Tenant isolation enforced by the database (forced Row Level Security), not only by application code. See Data storage and residency.
Authentication delegated to a dedicated provider, with MFA that admins can require organization-wide (Scale plan and above) and restrictions on allowed sign-in methods. SCIM 2.0 provisioning. SAML single sign-on is available on Enterprise ($75/mo per connection).
Access control by role, with many privileged actions recorded in an append-only audit log (not every admin change is covered yet). See Permissions and access control.
Encryption in transit with TLS and at rest through our infrastructure providers.
Incident response: a written plan with severity levels. We target notifying affected customer admins within 72 hours of confirming an incident that exposes their data. Any suspected cross-tenant exposure is treated as the highest severity.
Access review: our written policy is a quarterly self-review of admin access, authentication-provider access, SCIM tokens, directory connections and privileged database use, recorded in a dated log. The first review is due December 2026 and has not been performed yet.
Backups and recovery: database point-in-time restore and a written continuity plan. Restore testing is scheduled.
Security response headers on the web app, including clickjacking protection.
We are a very small engineering team and write our processes around that honestly rather than imply a larger on-call organization.
Documents available on request
These are shared by email, not posted publicly. Request what your review needs and we reply with a link or attachment.
Data Processing Addendum (DPA): GDPR/CCPA terms, EU Standard Contractual Clauses, breach notice, subprocessor list. Request by email
Information security policy: Roles, controls, review cycles. Request by email
If you believe you have found a security issue in Mucho Gusto, email [email protected] with the subject line "Security vulnerability report". Our contact details are also published in security.txt.
Include enough detail for us to reproduce it: affected page or endpoint, steps, and what you observed.
Please do not access, change or keep other people's data, and do not disrupt the service while testing.
Give us a reasonable chance to fix the issue before disclosing it publicly.
We will acknowledge and investigate reports. We do not currently run a bug bounty program.