generated: '2026-07-19'
method: searched
source: https://front.com/security + https://trust.front.com + app.frontapp.com OAuth metadata
standards:
- id: oauth2
  conforms: true
  evidence: Documented OAuth 2.0 authorization code flow (authorize/token endpoints at app.frontapp.com/oauth/*).
- id: oauth2.1-pkce
  conforms: true
  evidence: RFC 8414 authorization-server metadata advertises code_challenge_methods_supported=[S256] for the MCP server.
- id: rfc8414-as-metadata
  conforms: true
  evidence: /.well-known/oauth-authorization-server served at app.frontapp.com (200).
- id: rfc9116-security-txt
  conforms: true
  evidence: /.well-known/security.txt present with Contact and Bug Bounty fields.
- id: soc2-type-ii
  conforms: true
  evidence: front.com/security states "SOC 2 Type II ... certified"; report available via trust.front.com.
- id: iso-27001
  conforms: true
  evidence: front.com/security states "ISO 27001 certified"; certificate available via trust.front.com.
- id: gdpr
  conforms: true
  evidence: GDPR compliance stated on front.com/security.
- id: rfc9457-problem-details
  conforms: false
  evidence: No local OpenAPI captured; error envelope is a Front-specific `_error` object, not application/problem+json.
- id: fhir-r4
  conforms: false
- id: scim2
  conforms: false