generated: '2026-08-09'
method: searched
source: Conception public statements, its 2026-08-07 science update, and trade-press coverage (2026-08-09 web search)
scope: >-
  Conception publishes no API, so there are no API or cross-cutting technical standards
  to assert. What the company is actually measured against is the US clinical/biologics
  regulatory pathway for a stem-cell-derived reproductive therapy, plus the ethical and
  legal regimes that govern human germline and embryo research. Those are recorded here
  as the applicable regimes, with status stated honestly as pre-clinical rather than
  achieved. The API/protocol standards block is recorded as not-applicable rather than
  false, so this file is never mistaken for a compliance posture the company does not
  claim.
regulatory_regime:
- id: fda-cber-ind-cell-therapy
  name: >-
    US FDA CBER Investigational New Drug pathway for human cells, tissues and
    cellular/tissue-based products (21 CFR 1271 / 21 CFR 312)
  conforms: false
  status: pre-clinical
  evidence: >-
    Conception's 2026-08-07 update reports fully stem-cell-derived human ovarian
    follicles containing early oocytes progressing through meiosis - a laboratory
    milestone. The company itself states the next steps are growing follicles to the
    antral stage and "extensive safety validation" before any clinical application. No
    IND filing, clinical trial registration, or FDA clearance has been published.
  note: >-
    Recorded as conforms:false because no clinical authorization exists, not because
    the company failed a check. Re-probe on the next pass.
- id: us-appropriations-rider-heritable-modification
  name: >-
    US federal appropriations rider barring FDA review of applications involving
    heritable genetic modification of a human embryo
  conforms: false
  applicable: true
  evidence: >-
    In-vitro gametogenesis is repeatedly discussed in the bioethics literature (ISSCR
    guidance, Johns Hopkins Berman Institute coverage) as sitting adjacent to this
    restriction because the product is a gamete. Conception has published no statement
    of its regulatory reading of the rider.
  note: informational - a live policy constraint on the field, not a certification.
- id: isscr-guidelines-stem-cell-research
  name: ISSCR Guidelines for Stem Cell Research and Clinical Translation
  conforms: unknown
  applicable: true
  evidence: >-
    Standard governance framework for human iPSC and in-vitro gametogenesis work.
    Conception publishes no oversight/EAC statement on its site, so adherence cannot
    be verified from public sources.
api_standards:
- id: openapi
  conforms: false
  applicable: false
  evidence: no public API contract published (see well-known/conception-well-known.yml)
- id: oauth2
  conforms: false
  applicable: false
- id: openid-connect
  conforms: false
  applicable: false
- id: rfc9457-problem-details
  conforms: false
  applicable: false
- id: asyncapi
  conforms: false
  applicable: false
- id: mcp
  conforms: false
  applicable: false
- id: a2a
  conforms: false
  applicable: false
  evidence: >-
    /.well-known/agent-card.json and /.well-known/agent.json both 404 on
    conception.bio and www.conception.bio
- id: rfc9116-security-txt
  conforms: false
  applicable: true
  evidence: /.well-known/security.txt returns 404 on both conception.bio hosts
information_security_compliance:
  found: false
  note: >-
    No trust center, SOC 2, ISO 27001, HIPAA or equivalent information-security
    certification page was found by probe-security-programs.py (vdp=none trust=none)
    or by search. No `Compliance` pointer is wired in apis.yml - and the FDA/ISSCR
    regimes above are clinical and research-ethics regimes, not a published infosec
    compliance program, so they do not earn one either.
domain_security_observed:
  source: security/conception-domain-security.yml
  summary: >-
    www.conception.bio serves TLS 1.3 with HSTS (max-age 31536000) on a Framer-hosted
    origin. The conception.bio domain has an SPF record but NO DMARC record, NO CAA
    record and NO DNSSEC - three gaps worth flagging for a company whose only inbound
    channel is a Google Workspace mailbox (hello@conception.bio).