generated: '2026-07-19'
method: searched
source: https://www.fiddler.ai/security
notes: >-
  Cross-cutting standards / compliance posture for Fiddler. Security/compliance
  certifications verified from the public security page and SOC 2 announcement;
  API-level standards derived from the published REST API reference.
standards:
  - id: soc2-type-ii
    conforms: true
    evidence: 'SOC 2 Type II (Security, Availability, Confidentiality), audited annually; report on request under NDA.'
    source: https://www.fiddler.ai/blog/fiddler-announces-soc-2-type-ii-certification
  - id: hipaa
    conforms: true
    evidence: Fiddler states HIPAA compliance for handling PHI.
    source: https://www.fiddler.ai/security
  - id: opentelemetry
    conforms: true
    evidence: 'OTel-native ingestion (Fiddler OTel SDK, otel-collector-with-fiddler receiver); semantic mappings over OTel attributes.'
    source: https://docs.fiddler.ai/changelog/otel-sdk
  - id: bearer-token-auth
    conforms: true
    evidence: All REST/MCP endpoints require Authorization Bearer tokens.
  - id: oauth2
    conforms: false
  - id: rfc9457-problem-details
    conforms: false
    evidence: Errors use a custom ERROR envelope, not application/problem+json.
  - id: fhir-r4
    conforms: false