generated: '2026-08-13'
method: probed
source: >-
  live probes of https://demand-mcp.app.docketai.com plus
  https://www.docket.io/platform/security-and-trust and https://security.docketai.com/

standards:
  - id: oauth2
    conforms: true
    evidence: >-
      RFC 6749 authorization_code + refresh_token grants advertised at
      https://angelic-precision-36.authkit.app/oauth2/token
  - id: rfc8414-oauth-authorization-server-metadata
    conforms: true
    evidence: 'HTTP 200 at /.well-known/oauth-authorization-server on the MCP host'
  - id: rfc9728-oauth-protected-resource-metadata
    conforms: true
    evidence: 'HTTP 200 at /.well-known/oauth-protected-resource/mcp'
  - id: rfc7636-pkce
    conforms: true
    evidence: 'code_challenge_methods_supported: ["S256"]'
  - id: rfc7591-dynamic-client-registration
    conforms: true
    evidence: 'registration_endpoint published; the 401 body instructs clients to re-register automatically'
  - id: rfc8628-device-authorization-grant
    conforms: true
    evidence: 'device_authorization_endpoint published and urn:ietf:params:oauth:grant-type:device_code granted'
  - id: rfc6750-bearer-token
    conforms: true
    evidence: 'bearer_methods_supported: ["header"]; unauthenticated call returns error "invalid_token"'
  - id: rfc7662-token-introspection
    conforms: true
    evidence: 'introspection_endpoint published'
  - id: openid-connect
    conforms: partial
    evidence: >-
      openid/profile/email scopes and a jwks_uri are advertised, but no
      /.well-known/openid-configuration is served on the MCP host (404)
  - id: mcp-streamable-http
    conforms: true
    evidence: >-
      Docket documents "Remote MCP or Streamable HTTP" and the endpoint answers
      JSON-RPC POSTs at https://demand-mcp.app.docketai.com/mcp
  - id: rfc9116-security-txt
    conforms: false
    evidence: '/.well-known/security.txt returns 404 on every Docket host'
  - id: rfc9457-problem-details
    conforms: false
    evidence: >-
      the only observable error envelope is the OAuth 2.0 {error, error_description}
      form, not application/problem+json
  - id: a2a-agent-card
    conforms: false
    evidence: 'no /.well-known/agent-card.json or /.well-known/agent.json on any host'
  - id: openapi
    conforms: false
    evidence: 'no OpenAPI/Swagger document found on any Docket host'
  - id: asyncapi
    conforms: false
    evidence: 'no published event, streaming or webhook surface'
  - id: llms-txt
    conforms: true
    evidence: >-
      two published llms.txt documents — https://www.docket.io/llms.txt and
      https://help.docket.io/llms.txt

compliance_program:
  published: true
  url: https://www.docket.io/platform/security-and-trust
  trust_portal: https://security.docketai.com/
  certifications:
    - SOC 2 Type I
    - SOC 2 Type II
    - ISO 27001
    - GDPR
  claims:
    - 'Data encrypted in transit and at rest'
    - 'Complete audit trails for every conversation'
    - 'Docket does not use customer data to train its models'
    - 'Role-based access control (RBAC) across agents, knowledge sets and conversation data'
    - 'Customer data is deleted upon contract termination'
    - 'Custom data residency / hosting available on the Enterprise plan'
  source: https://www.docket.io/llms.txt
  note: >-
    Certification claims are the provider's own published statements; API Evangelist
    has not seen the audit reports, which sit behind the trust portal.