generated: '2026-07-18'
method: derived
source: openapi/demodesk-v2-openapi.yml, https://security.demodesk.com
standards:
- id: oauth2
  conforms: true
  evidence: MCP server publishes RFC 8414 authorization-server metadata with authorization_code + PKCE (S256).
- id: oidc
  conforms: false
  evidence: No /.well-known/openid-configuration (404).
- id: rfc8414-oauth-as-metadata
  conforms: true
  evidence: /.well-known/oauth-authorization-server returns 200.
- id: rfc9728-oauth-protected-resource
  conforms: true
  evidence: /.well-known/oauth-protected-resource returns 200 for https://demodesk.com/mcp.
- id: rfc9457-problem-details
  conforms: false
  evidence: Errors use a custom application/json envelope, not application/problem+json.
- id: cursor-pagination
  conforms: true
  evidence: List endpoints return meta.nextCursor / meta.hasNext.
- id: iso27001
  conforms: true
  evidence: ISO 27001:2022 certified per https://security.demodesk.com and llms.txt.
- id: gdpr
  conforms: true
  evidence: GDPR-native, EU-only data residency (Azure Frankfurt); Article 28 processor.
compliance_program:
  url: https://security.demodesk.com
  certifications: [ISO 27001:2022, GDPR]