generated: '2026-07-18'
method: searched
source: https://developer.digits.com/docs + https://digits.com/security/
standards:
- id: oauth2
  conforms: true
  evidence: OAuth 2.0 authorization code grant documented; authorize/token endpoints on connect.digits.com.
- id: oauth2-pkce
  conforms: true
  evidence: authorization-server metadata advertises code_challenge_methods_supported [S256].
- id: rfc8414-oauth-authorization-server-metadata
  conforms: true
  evidence: /.well-known/oauth-authorization-server published at api.digits.com (200).
- id: rfc7591-dynamic-client-registration
  conforms: true
  evidence: registration_endpoint published in authorization-server metadata.
- id: rfc9116-security-txt
  conforms: true
  evidence: /.well-known/security.txt published at digits.com (200).
- id: rfc8594-sunset-header
  conforms: true
  evidence: deprecated endpoints include sunset timelines in response headers (versioning docs).
- id: cursor-pagination
  conforms: true
  evidence: cursor-based pagination with limit/cursor params and next.cursor/next.more response fields.
- id: idempotency
  conforms: true
  evidence: idempotent upsert on externalId for sync endpoints (identifiers docs).
- id: soc2-type-ii
  conforms: true
  evidence: SOC 2 Type II compliant per digits.com/security and trust.digits.com.
- id: mcp
  conforms: true
  evidence: hosted MCP server + spec-compliant MCP Server Card (SEP-1649) at /.well-known/mcp/server.json.
- id: rfc9457-problem-details
  conforms: false
  evidence: error responses not documented as application/problem+json.
compliance_program:
  soc2_type_ii: true
  trust_center: https://trust.digits.com
  security_page: https://digits.com/security/