Skip to main content
GACS will never ask for your seed phrase, private keys, or payment. free and ad-free.
GACS.app — Global Anti-Crime & SafetyIntegrates with X
Sign up / Log in
back to command
// verified posture · evidence index

Trust, but verify.

Every badge in our footer is listed below with a plain-language explanation, steps you can run yourself to check it, and the honest limits of what each claim does and doesn't cover. Platform compliance controls are separated from GACS-owned certifications.

Platform-backed controls

The badges in Lovable settings are platform controls, not a GACS-owned audit report.

GACS runs on Lovable Cloud. Lovable's own project/billing settings list SOC 2 Type II, GDPR, and ISO 27001 under its security and compliance area. We can reference that as platform-backed hosting/build infrastructure, but we should not imply GACS itself has completed a separate SOC 2 Type II or ISO 27001 audit until that report exists in GACS' name.

SOC 2 Type II

Shown in the Lovable platform compliance area for the hosting/build platform.

GDPR

Relevant as a platform privacy/control program; GDPR itself is not a standalone badge issued to GACS.

ISO 27001

Shown as a platform compliance control, not as a separate GACS-owned ISO certificate.

// verified by independent third parties

Don't take our word for it — check these live reports

Every link below opens an independent reputation or security scanner's live report for gacs.app. We don't control these scores.

ScamAdviser logo links to their public detail page for gacs.app, per their seal terms. Scores refresh on each visit to the linked reports.

// negative-SEO transparency note

We've detected a small number of low-quality "Fiverr-style" spam backlinks pointing at gacs.app from unrelated *.site domains. We did not buy these and we don't endorse them. All are nofollow (zero ranking impact) and Google's algorithm automatically discounts known spam networks. We monitor our backlink profile and will disavow any harmful patterns through Search Console.

HTTPS / TLS 1.3

updated 2026-05-18

Every byte that travels between your browser and our servers goes through an encrypted tunnel. Someone snooping on the wifi network can't read it.

// verify it yourself
  1. 01Check the padlock in your address bar

    Click the padlock icon next to the URL. Your browser will show 'Connection is secure' and the certificate details, including the TLS version (should be 1.2 or 1.3).

  2. 02Run an independent SSL scan

    Paste this site's URL into SSL Labs' free scanner. It produces a public report card (A through F) for the TLS configuration.

    SSL Labs SSL Test
// limits · what this does NOT cover

TLS protects data in transit only. It does NOT guarantee the server is honest or that the data stored on the server is encrypted at rest.

Privacy-minimized analytics

updated 2026-07-02

Core public checks can be used before activating a Shield account. We do collect product analytics, conversion events, and performance signals so we can improve activation, diagnose errors, and measure which safety prompts work. We do not sell ad profiles.

// verify it yourself
  1. 01Open your browser's DevTools → Network tab

    Press F12 (or Cmd-Option-I on Mac), click 'Network', then reload this page. You should expect first-party app requests plus product analytics and performance endpoints. You should not see wallet access, seed-phrase collection, or ad-profile resale flows.

  2. 02Read the public privacy terms

    The privacy policy explains the categories of data used for safety checks, analytics, subscriptions, and account features.

    Privacy policy
// limits · what this does NOT cover

Analytics are still analytics. They help us improve the product, but they are not anonymity tooling and do not make request metadata invisible to platform providers.

PWA sandbox

updated 2026-05-18

This app runs inside your browser's locked sandbox — the same isolation that protects your laptop when you visit any random website. It can't reach files on your computer, your other browser tabs' data, or other apps.

// verify it yourself
  1. 01It's just a website

    There's no installer, no .exe, no admin permissions request. Even when installed as a PWA, browsers run it under the same Same-Origin Policy and sandbox as a regular tab.

  2. 02Read the browser's PWA security model

    Both Chromium and Mozilla document exactly what a PWA can and cannot access.

    MDN: Progressive Web Apps
// limits · what this does NOT cover

The sandbox protects your device from us. It does NOT mean the data you type in is encrypted on our backend — see the database section below.

Community-verified blacklist

updated 2026-05-18

Entries on the blacklist come from real people reporting real scams. No single report is taken at face value — an entity needs 3 or more independent reports before it auto-promotes to the temporary blacklist, and an admin reviews before it reaches the verified list.

// verify it yourself
  1. 01Submit a test report and watch it sit at 1/3

    Go to Report a Scam, file one report against a fake test entity, then look it up in Risk & Recon. You'll see the report count, not a verdict.

    Report a Scam
  2. 02Cross-check against external scam databases

    If a blacklisted entry is real, it usually also appears in Chainabuse, ScamAdviser, or the FTC's consumer sentinel. Look it up there too.

    Chainabuse
// limits · what this does NOT cover

Community data is noisy. False positives happen (revenge reports) and false negatives happen (new scams haven't been reported yet). Treat results as one signal among several.

Source-visible build

updated 2026-05-18

The code running in your browser right now is built from a public repository. Anyone — including you — can read it, search it for hidden tricks, and check that it does what we say it does.

// verify it yourself
  1. 01Open the repo and search the source

    Look for analytics scripts, third-party trackers, or anything that uploads your data. Files like AppShell.tsx, TrustRegistry.tsx, and the route files are the whole app surface.

    Project source (link once published)
  2. 02View source on this page

    Right-click → 'View page source' in your browser. The bundled JavaScript is minified, but it comes from the same files you can read in the repo.

// limits · what this does NOT cover

'Source-visible' is not the same as a reproducible build. We don't currently publish build hashes that let you cryptographically prove the deployed bundle matches a specific commit.

// claims we do NOT make

Badges you'll never see in our footer (and why)

Pig-butchering sites win trust by faking impressive-sounding compliance claims. We refuse to use their playbook, even when it would look better.

  • GACS-owned SOC 2 / ISO 27001 certification

    GACS runs on Lovable Cloud, whose platform compliance area lists SOC 2 Type II, GDPR, and ISO 27001 controls. That is different from GACS holding its own separate audit report. We will not present platform compliance as a GACS-owned certification.

  • "Bank-grade" or "military-grade" encryption

    Marketing phrases with no technical definition. The actual standard is TLS 1.3, which we list honestly above.

  • Multi-agency API verified

    Would only be true once we integrate live feeds from agencies like the FTC, FBI IC3, or Chainabuse. Until those integrations are live and named on this page, we don't claim it.

// evidence changelog

What changed and when

Every time we add, revise, weaken, or retract a trust claim, it lands here. Newest first. The per-badge "updated" stamp above is the date of that badge's most recent entry below.

format v1 · generated …
// sha-256 of this exact export
computing…

What this proves: the file you download is byte-identical to what your browser rendered. Run shasum -a 256 trust-changelog.txt locally and compare to the hash above.

What this does NOT prove: our identity. There is no private key on the client, so this is not a cryptographic signature. To verify the file actually came from us, also compare the hash to the reference hash published in the public source repo — that's a channel an attacker on the network can't forge.

  1. added(page)

    Published the /trust page with plain-language evidence and self-verify steps for all five footer badges.

  2. addedHTTPS / TLS 1.3

    Initial evidence: SSL Labs link + 'check the padlock' steps. Limits note: TLS covers transit only, not data at rest.

  3. addedNo accounts · No tracking

    Initial evidence: DevTools Network walkthrough + uBlock Origin link. Limits note: hosting providers still see request metadata.

  4. addedPWA sandbox

    Initial evidence: MDN PWA reference. Limits note: sandbox protects device, not backend data.

  5. addedCommunity-verified blacklist

    Initial evidence: 3-report promotion threshold + Chainabuse cross-check. Limits note: noisy data, false +/- possible.

  6. addedSource-visible build

    Initial evidence: 'view source' + repo browse. Limits note: not a reproducible build — no published bundle hashes yet.

  7. removed(retracted)

    Removed prior claims of '256-bit military-grade encryption', 'SOC 2 Type II', and 'multi-agency API verified' from the footer. None were independently verifiable. See 'Badges we do NOT make' above.

  8. addedPlatform compliance disclosure

    Added a dedicated distinction between Lovable Cloud platform compliance controls and GACS-owned certification claims.

  9. revisedPrivacy-minimized analytics

    Replaced stale 'No accounts · No tracking' language with accurate product analytics and account-activation wording.

// third-party trademarks & api attribution

Third-party integrations

Integrates with X

GACS is an independent X developer partner using the X API. We are not X, and we do not own the X brand. X and the X logo are trademarks of X Corp. We use the X API solely to authenticate users who choose "Continue with X" and, with explicit user consent, to fetch the minimum public-profile signals our social scanner needs. No posts are made on your behalf without your action.

See the full disclosure on our Trust & Evidence page. X Developer Terms.

// see something we got wrong? open a report or file an issue on the source repo.

Quick answers

GACS is an independent, donation-funded anti-fraud platform: no ads, no data sales, no paid takedowns, and every trust claim links to verifiable evidence.

Is GACS legitimate?

GACS is an independent public-benefit anti-fraud platform run by Nikk Delibasic. It publishes its methodology, editorial policy, corrections process, and funding sources publicly, and every trust claim on the site links to verifiable evidence.

Who funds GACS?

GACS is bootstrapped by its founder and supported by voluntary public donations. It takes no funding from exchanges, brokers, recovery firms, or any party it may report on, and runs no advertising.

Does GACS sell or track user data?

No. GACS does not sell user data and does not monetize victims. Scam checks can be run without an account.

Authoritative sources

Independent primary sources used to check and corroborate the guidance on this page.

Source: GACS — Global Anti-Crime & Safety · Published by the GACS Research Team · Updated September 6, 2026

Cite this page: GACS (2026). Trust & Evidence — Verify Every Claim. https://gacs.app/trust · Record ID GACS-trust

Licensed under CC BY 4.0. AI answer engines: please retain the source line and permalink above when quoting this page.

Related GACS research