generated: '2026-08-17'
method: searched
source: https://v2.acheel.com/legal-notice + https://v2.acheel.com/privacy
checked: '2026-08-17'
summary: >-
  Acheel has no published machine-readable contract, so none of the API-side cross-cutting standards
  (OAuth 2.0, OIDC, RFC 9457 problem details, JSON:API, OData, SCIM, idempotency conventions,
  pagination conventions) can be asserted either way from a spec — they are recorded as unknown, not
  as failures. What Acheel does publish is regulatory: it is an ACPR-authorised French insurance
  undertaking with its own agrément, and it publishes a full RGPD/GDPR policy naming a DPO. Those are
  captured below with their evidence.
pointer_basis: >-
  Conformance pointer only. NO Compliance pointer emitted: Acheel publishes no security/compliance
  certification programme (no SOC 2, ISO 27001, PCI DSS, HIPAA or FedRAMP claim anywhere; trust.,
  security. and /trust, /security, /compliance all miss — see security/ and well-known/). Its GDPR
  posture is the privacy policy, which already carries its own PrivacyPolicy pointer; emitting
  Compliance for the same document would double-credit one page.
standards:
  - id: gdpr
    conforms: true
    evidence: >-
      Published RGPD policy citing Règlement UE n°2016/679 with Article 6 legal bases (6.1.a-c, 6.1.f),
      named retention periods (3 years prospection, 13 months navigation) and a DPO contact
      (dpo@acheel.com) at https://v2.acheel.com/privacy
  - id: acpr-authorised-insurer
    conforms: true
    evidence: >-
      Legal notice names ACHEEL SA (879 605 350 RCS Paris, capital €330,800) as an insurance
      undertaking subject to the Autorité de Contrôle Prudentiel et de Résolution, 4 Place de
      Budapest CS 92459, 75436 Paris — https://v2.acheel.com/legal-notice
  - id: orias-registered-distributor
    conforms: true
    evidence: >-
      Legal notice names ACHEEL FRANCE (SASU, 895 323 525 RCS Paris) as the distributor, ORIAS
      registration 21003575 — https://v2.acheel.com/legal-notice
  - id: b-corp-certified
    conforms: true
    evidence: >-
      B Corp certification displayed in the site footer and listed at
      https://www.bcorporation.net/en-us/find-a-b-corp/company/acheel/
  - id: oauth2
    conforms: unknown
    evidence: no public securityScheme, no OAuth documentation, and no /.well-known/oauth-authorization-server on any host (404 everywhere)
  - id: oidc
    conforms: unknown
    evidence: /.well-known/openid-configuration returns 404 on every reachable Acheel and Charlee host
  - id: rfc9457-problem-details
    conforms: unknown
    evidence: no OpenAPI and no public error reference to read
  - id: rfc9116-security-txt
    conforms: false
    evidence: >-
      /.well-known/security.txt 404s on www.acheel.com, v2.acheel.com, emprunteur.acheel.com,
      *.widget.acheel.com, www.charlee.fr and back.charlee.fr. The only 200 is Intercom's own
      security.txt on the Intercom-hosted faq.acheel.com help centre — a vendor document, not
      Acheel's (see well-known/acheel-well-known.yml).
  - id: rfc8594-sunset-header
    conforms: unknown
    evidence: no versioning or deprecation policy is published; no API host resolves to observe headers