generated: '2026-08-06'
method: derived
source: 'well-known/aravo-openid-configuration.json + aravo.com integration-framework marketing
  pages (https://aravo.com/intelligence-first-platform/integration-framework/connectors/)'
note: 'No Aravo OpenAPI, WSDL or public API reference was found, so every entry below is
  derived from what Aravo states publicly or from a document actually served on an Aravo host.
  Nothing here is a certification claim: Aravo publishes no SOC 2, ISO 27001, PCI or FedRAMP
  attestation on its public site, so no Compliance pointer is emitted.'
standards:
- id: oidc
  conforms: true
  scope: customer-portal-login
  evidence: 'https://aravo.my.site.com/.well-known/openid-configuration returned 200
    application/json with issuer, authorization_endpoint, token_endpoint, jwks_uri and
    id_token_signing_alg_values_supported (RS256); this is the Salesforce Experience Cloud
    IdP fronting the Aravo customer portal, not a documented Aravo product API'
- id: oauth2
  conforms: true
  scope: customer-portal-login
  evidence: 'same discovery document advertises /services/oauth2/authorize, /token, /revoke,
    /introspect and /register (RFC 7591 dynamic client registration)'
- id: rest
  conforms: unknown
  evidence: 'Aravo states its integration framework "enables data exchange via web services
    APIs in XML and JSON formats using SOAP and REST-based protocols"
    (https://aravo.com/intelligence-first-platform/integration-framework/connectors/), but no
    machine-readable contract is published to verify shape, versioning or resource model'
- id: soap
  conforms: unknown
  evidence: same marketing claim; no WSDL was found on any Aravo host
- id: openapi
  conforms: false
  evidence: 'no OpenAPI/Swagger document at any probed path on aravo.com or aravo.my.site.com
    (see well-known/aravo-well-known.yml)'
- id: asyncapi
  conforms: false
  evidence: no published event, streaming or webhook catalog found
- id: rfc9457-problem-details
  conforms: unknown
  evidence: no public error reference
- id: rfc9116-security-txt
  conforms: false
  evidence: https://aravo.com/.well-known/security.txt returned 404
- id: a2a
  conforms: false
  evidence: '/.well-known/agent-card.json and /.well-known/agent.json returned 404 on
    aravo.com and 401 on aravo.my.site.com'
compliance_program:
  published: false
  note: 'Aravo sells compliance software (GDPR, DORA, LkSG, ABAC modules) but publishes no
    trust center and no named security certification on aravo.com; the only certification
    named on the public site is a Net Zero Contributor Certification, which is environmental,
    not security or privacy.'