generated: '2026-08-02'
method: derived
source: openapi/*.json + https://docs.bigeye.com/docs/security-and-compliance + https://www.bigeye.com/platform/security
standards:
- id: openapi-3.0
  conforms: true
  evidence: All three published definitions declare openapi 3.0.0 and parse with 263
    operations across 209 paths.
  artifacts: [openapi/bigeye-metadata-openapi.json, openapi/bigeye-observability-openapi.json,
    openapi/bigeye-sensitivity-openapi.json]
- id: rfc9727-api-catalog
  conforms: true
  evidence: https://docs.bigeye.com/.well-known/api-catalog returns 200 application/linkset+json
    listing all three OpenAPI definitions as service-desc links.
  artifacts: [well-known/bigeye-api-catalog.json]
- id: rfc9264-linkset
  conforms: true
  evidence: The api-catalog document is an RFC 9264 linkset with anchor / service-desc
    / service-doc members.
- id: model-context-protocol
  conforms: true
  evidence: Hosted MCP server at https://mcpgateway.bigeye.com/mcp answers JSON-RPC
    tools/list over streamable HTTP with 56 tools carrying inputSchema and outputSchema.
  artifacts: [mcp/bigeye-mcp.yml, mcp/bigeye-mcp-tools-list.json]
- id: llmstxt
  conforms: true
  evidence: https://docs.bigeye.com/llms.txt returns 200 text/plain, 505 lines, with
    Guides / API Reference / Recipes link sections.
  artifacts: [llms/bigeye-llms.txt]
- id: grpc-gateway
  conforms: true
  evidence: All specs carry protobufAny and runtimeError components and "generated"-prefixed
    schema names; operationIds follow <Service>_<Method>. The underlying services
    are gRPC, though no .proto files are published.
- id: oauth2
  conforms: false
  evidence: No oauth2 securityScheme in any spec and no OAuth flow documented for the
    Bigeye API. (Auth0 is used for end-user SSO into the app, not for API authorization.)
- id: oidc
  conforms: false
  evidence: No openIdConnect securityScheme; /.well-known/openid-configuration returns
    404 on every host.
- id: rfc9457-problem-details
  conforms: false
  evidence: Errors use the grpc-gateway runtimeError object on application/json, not
    application/problem+json.
- id: idempotency-key
  conforms: false
  evidence: No Idempotency-Key parameter, header or body field in any of the 263 operations,
    and no retry-safety contract in the docs.
- id: rfc8594-sunset-header
  conforms: false
  evidence: No deprecation policy and no Sunset/Deprecation header support documented.
- id: rfc9116-security-txt
  conforms: false
  evidence: /.well-known/security.txt returns 404 on www.bigeye.com, docs.bigeye.com
    and mcpgateway.bigeye.com.
- id: a2a-agent-card
  conforms: false
  evidence: /.well-known/agent-card.json and /.well-known/agent.json return 404 on
    every Bigeye host (app.bigeye.com answers 200 with an SPA HTML shell for all
    /.well-known/* paths, which was rejected as a false positive).
- id: asyncapi
  conforms: false
  evidence: No AsyncAPI document published; the event surface is a documented webhook
    only. See asyncapi/bigeye-webhooks.yml.
- id: json-api
  conforms: false
  evidence: Responses are plain JSON objects generated from protobuf messages, not
    JSON:API documents.
- id: odata
  conforms: false
- id: scim2
  conforms: false
  evidence: User, group and role management is exposed through Bigeye's own
    UserService/GroupService/RoleService operations, not SCIM 2.0 endpoints.
compliance_program:
  published: true
  source: https://docs.bigeye.com/docs/security-and-compliance
  certifications:
  - {id: soc2-type-2, name: SOC 2 Type 2, status: reported, evidence: 'Security and
      Compliance page: "SOC 2 Type 2 Report"; "Bigeye is a fully managed SOC 2 and
      ISO 27001 compliant SaaS application."'}
  - {id: iso-27001, name: ISO 27001, status: certified, evidence: 'Security and Compliance
      page: "ISO 27001 Certification".'}
  controls:
  - {control: encryption-at-rest, detail: AES-256 via AWS-managed RDS.}
  - {control: encryption-in-transit, detail: TLS v1.2 or higher.}
  - {control: penetration-testing, detail: Annual third-party application-layer penetration
      test; reports available on demand.}
  - {control: vulnerability-scanning, detail: Code review plus dependency vulnerability
      scans in the engineering process.}
  - {control: background-checks, detail: All employees screened via Checkr.}
  - {control: sso, detail: 'Okta, Ping Identity and Azure AD for Enterprise; Auth0 as
      the SSO provider.'}
  - {control: waf, detail: AWS WAF Security Automation.}
  - {control: dpa, detail: Data Processing Addendum available on request.}
  - {control: private-networking, detail: AWS PrivateLink available on Bigeye Enterprise.}
  - {control: least-privilege-data-access, detail: Read-only service accounts over JDBC;
      only aggregate statistics, query logs and metadata are extracted, never raw
      data.}
  hosting: AWS