generated: '2026-09-02'
method: probed
source: >-
  Live probes of https://formboost.app on 2026-09-02, plus https://formboost.app/security,
  https://formboost.app/privacy and https://formboost.app/docs/http-webhook
standards:
  - id: draft-ietf-httpapi-ratelimit-headers
    name: IETF RateLimit header fields for HTTP
    conforms: true
    evidence: >-
      Live responses from https://formboost.app/f/{alias} carry ratelimit-limit,
      ratelimit-policy (10;w=60), ratelimit-remaining and ratelimit-reset. The modern draft
      family, not the legacy X-RateLimit-* names. Probed 2026-09-02.
  - id: rfc9457
    name: Problem Details for HTTP APIs
    conforms: false
    evidence: >-
      Errors return application/json with a bespoke {success, message, name, hint, documentation}
      envelope. No application/problem+json, no type/title/status/detail members.
      Probed 2026-09-02.
  - id: rfc9116
    name: security.txt
    conforms: false
    evidence: >-
      https://formboost.app/.well-known/security.txt returns 404. A vulnerability reporting
      address (security@formboost.app) IS published, but on an HTML page rather than at the
      well-known path. Probed 2026-09-02.
  - id: rfc8594
    name: Sunset HTTP header
    conforms: false
    evidence: No Sunset or Deprecation header observed on any response. Probed 2026-09-02.
  - id: rfc6797
    name: HTTP Strict Transport Security
    conforms: true
    evidence: >-
      strict-transport-security: max-age=15552000; includeSubDomains; preload — on both the
      marketing host and the submission endpoint. Probed 2026-09-02.
  - id: rfc9110-content-negotiation
    name: HTTP proactive content negotiation
    conforms: true
    evidence: >-
      Pages serve text/html or text/markdown by Accept, set Vary: Accept, and return 406 with a
      list of available representations when Accept cannot be satisfied. Probed 2026-09-02.
  - id: csp-level-3
    name: Content Security Policy
    conforms: true
    evidence: >-
      A restrictive CSP is set on both hosts (default-src 'self'; object-src 'none';
      frame-ancestors 'self'; base-uri 'self'), alongside the Helmet header set — Formboost's
      security page names Helmet explicitly. Probed 2026-09-02.
  - id: gdpr
    name: EU General Data Protection Regulation
    conforms: true
    evidence: >-
      https://formboost.app/security sets out the controller/processor split explicitly (the
      customer is controller, Formboost is processor), enumerates every subprocessor with what it
      can see, documents access/portability/erasure mechanisms, and offers a DPA on request. The
      FAQ states "We're GDPR compliant." This is a self-declared programme, not an audited one.
  - id: oauth2
    name: OAuth 2.0
    conforms: partial
    evidence: >-
      Formboost is an OAuth CLIENT to Google (drive.file scope) for the Sheets integration. It is
      not an OAuth authorization server — no /.well-known/oauth-authorization-server (404),
      no token issuance, no scope surface for third parties.
  - id: oidc
    name: OpenID Connect
    conforms: partial
    evidence: >-
      Sign-in is delegated to Google Firebase, an OIDC provider. Formboost itself publishes no
      /.well-known/openid-configuration (404 probed 2026-09-02) and is not an OP.
  - id: llmstxt
    name: llms.txt
    conforms: true
    evidence: >-
      https://formboost.app/llms.txt (200, text/plain, 18KB) and /llms-full.txt (200, 246KB),
      both cross-referenced from robots.txt. Probed 2026-09-02.
  - id: sitemaps-org
    name: Sitemaps XML protocol
    conforms: true
    evidence: >-
      https://formboost.app/sitemap.xml (200, text/xml) plus per-section sitemaps for /docs and
      /blog declared in robots.txt. Probed 2026-09-02.
  - id: asyncapi
    name: AsyncAPI
    conforms: false
    evidence: >-
      A webhook event surface exists and is well documented, but no AsyncAPI document is
      published. See asyncapi/formboost-webhooks.yml.
  - id: openapi
    name: OpenAPI
    conforms: false
    evidence: >-
      No OpenAPI at any probed location on formboost.app, service.formboost.app,
      dashboard.formboost.app or status.formboost.app. See the coverage note in apis.yml.
  - id: idempotency
    name: Idempotent HTTP write semantics
    conforms: false
    evidence: >-
      POST /f/{alias} accepts no idempotency key and no client token; a retry creates a second
      submission. See conventions/formboost-conventions.yml.
  - id: pagination
    name: Collection pagination
    conforms: na
    evidence: No public collection endpoint exists.
domain_standard:
  applicable: false
  detail: >-
    REWARD-ONLY, and correctly empty. The form-backend / form-submission market has no
    interoperability standard — there is no shared schema, message type or identifier scheme that
    Formspree, Getform, Basin, Formspark, Web3Forms and Formboost could all speak. Each vendor
    defines its own endpoint shape and its own webhook envelope, so switching backends means
    rewriting the integration regardless of vendor. Nothing was invented to fill this slot.
    The nearest thing to a portable contract in this market is the plain HTML <form> element
    itself, which Formboost does honour: a standards-compliant form with a changed `action`
    attribute and no JavaScript works against it.
  probed_shortlist:
    - standard: SCIM (urn:ietf:params:scim:schemas:*)
      present: false
    - standard: OData $metadata
      present: false
    - standard: ActivityPub
      present: false
    - standard: OAI-PMH
      present: false
    - standard: WebSub
      present: false
      note: Would be the natural fit for a submission event feed; not implemented.
certifications:
  held: []
  detail: >-
    NONE. Formboost states this itself, unprompted and emphatically:
    "We hold no third-party certifications — no SOC 2 report, no ISO 27001, no independent
    penetration test to share yet. Anyone claiming otherwise about us is wrong."
    See security/formboost-trust-center.yml for the correction this required.
  source: https://formboost.app/security