generated: '2026-07-18'
method: derived
source: openapi/doppel-openapi-original.yml
standards:
- id: oauth2
  conforms: false
  evidence: No oauth2 securityScheme; auth is apiKey (x-api-key + x-user-api-key) only.
- id: oidc
  conforms: false
- id: rfc9457-problem-details
  conforms: false
  evidence: Errors use a custom application/json '{message}' envelope, not application/problem+json.
- id: webhooks
  conforms: true
  evidence: OpenAPI webhooks[] defines 6 event types (url_surfaced, report_surfaced, alert_updated,
    ioc_updated, hrm_event, sms_response).
- id: pagination
  conforms: true
  evidence: Consistent page/page_size (zero-indexed, default 30, max 200) across list endpoints.
- id: idempotency
  conforms: false
  evidence: No client-supplied idempotency-key header documented.
- id: soc2-type-ii
  conforms: true
  evidence: SOC 2 Type II attestation (issued 2025-01-20), per trust.doppel.com and /security.
- id: iso-27001
  conforms: true
  evidence: ISO/IEC 27001:2022 certified (trust center).
- id: iso-42001
  conforms: true
  evidence: ISO/IEC 42001:2023 (AI management systems) certified — among first ~350 orgs worldwide.
- id: iso-27701
  conforms: true
  evidence: ISO/IEC 27701 (privacy information management) certified.
- id: gdpr
  conforms: true
  evidence: GDPR posture documented at trust.doppel.com.
compliance_program:
  published: true
  url: https://trust.doppel.com/
  certifications: [SOC 2 Type II, ISO/IEC 27001:2022, ISO/IEC 42001:2023, ISO/IEC 27701, GDPR]