generated: '2026-08-14' method: searched source: >- openapi/_original/fullenrich-openapi.yml, the published /.well-known/ metadata on app.fullenrich.com and mcp.fullenrich.com, https://fullenrich.com/trust, https://fullenrich.com/pricing.md, and the FullEnrich MCP/Agent-Skills manifests at https://github.com/FullEnrich/fullenrich-skills. description: >- Which cross-cutting standards the FullEnrich surface actually conforms to. The agent-facing stack (MCP, OAuth discovery, A2A, Agent Skills, llms.txt) is unusually complete for a company this size; the REST API itself is conventional and does not adopt the HTTP-level standards (RFC 9457, RFC 8594, RateLimit headers) that would make it machine-legible. standards: - id: openapi-3.1 conforms: true evidence: >- Published OpenAPI 3.1.0 at https://mintcdn.com/fullenrich/QlQ00joQ41SH1_-N/api/v2/reference/openapi.yml, linked from https://docs.fullenrich.com/llms.txt. 10 operations, 38 schemas, every operation has an operationId, summary and description. - id: oauth2 conforms: true evidence: >- Two authorization servers. app.fullenrich.com supports authorization_code (PKCE S256), client_credentials and refresh_token with 13 scopes. mcp.fullenrich.com supports authorization_code + refresh_token with dynamic client registration. - id: rfc8414-oauth-authorization-server-metadata conforms: true evidence: >- /.well-known/oauth-authorization-server returns 200 application/json on both app.fullenrich.com and mcp.fullenrich.com. - id: rfc9728-oauth-protected-resource-metadata conforms: true evidence: >- https://mcp.fullenrich.com/.well-known/oauth-protected-resource returns the resource + authorization_servers + scopes_supported document, and an unauthenticated MCP call returns 401 with `WWW-Authenticate: Bearer resource_metadata="..."` pointing at it. - id: oidc-discovery conforms: partial evidence: >- /.well-known/openid-configuration is served on app.fullenrich.com with jwks_uri and id_token_signing_alg_values_supported (HS256). It is byte-identical to the oauth-authorization-server document and omits userinfo_endpoint, so it is OAuth metadata published at the OIDC path rather than a full OpenID Provider. - id: pkce-rfc7636 conforms: true evidence: code_challenge_methods_supported ["S256"] on both authorization servers. - id: rfc7591-dynamic-client-registration conforms: true evidence: registration_endpoint https://mcp.fullenrich.com/register. - id: mcp conforms: true evidence: >- First-party remote MCP server at https://mcp.fullenrich.com/mcp, Streamable HTTP transport, 13 published tools, listed in the MCP Registry as io.github.FullEnrich/fullenrich v1.0.3 via a server.json manifest published by a version-locked GitHub Actions OIDC workflow. - id: a2a conforms: true grade: conformant evidence: >- Agent Card served at https://docs.fullenrich.com/.well-known/agent-card.json — capabilities is an object, protocolVersion present, skills is an array. Uses pre-1.0 `supportedInterfaces` naming. Graded in a2a/fullenrich-a2a.yml. - id: agent-skills conforms: true evidence: >- Nine SKILL.md files published MIT-licensed at github.com/FullEnrich/fullenrich-skills, plus one served from docs.fullenrich.com/.well-known/agent-skills/full-enrich/skill.md. - id: llms-txt conforms: true evidence: >- https://docs.fullenrich.com/llms.txt returns a real llms.txt indexing every docs page as .md, plus the OpenAPI spec URL and the MCP server link. note: >- Served on the docs host only. https://fullenrich.com/llms.txt returns 404, though the marketing site does serve a machine-readable /pricing.md. - id: rfc9457-problem-details conforms: false evidence: >- Errors use a proprietary { code, message } envelope with media type application/json. No application/problem+json anywhere in the spec. - id: rfc8594-sunset-header conforms: false evidence: No Sunset or Deprecation header support and no deprecation policy published. - id: ratelimit-headers conforms: false evidence: >- A 60 req/min limit is documented in prose and 429 is returned on exhaustion, but no RateLimit-*, X-RateLimit-* or Retry-After response header is documented. See rate-limits/fullenrich-rate-limits.yml. - id: idempotency-key conforms: false evidence: >- No Idempotency-Key header or parameter in the spec or docs. Credit-level deduplication exists but does not provide idempotent request semantics — see conventions/fullenrich-conventions.yml. - id: asyncapi conforms: false evidence: >- Webhooks are documented in prose with two events and HMAC-SHA1 signing, but no AsyncAPI document is published. Captured in asyncapi/fullenrich-webhooks.yml. - id: webhook-signature-verification conforms: partial evidence: >- Webhooks are signed (X-Signature-SHA1, HMAC-SHA1 over the raw body). Weaker than the HMAC-SHA256 norm, uses the API key as the signing secret rather than a dedicated one, and includes no timestamp, so it does not defend against replay. - id: json-schema conforms: true evidence: OpenAPI 3.1.0 uses JSON Schema 2020-12 for its 38 component schemas. - id: rfc9116-security-txt conforms: false evidence: >- No security.txt on fullenrich.com, app.fullenrich.com, docs.fullenrich.com or mcp.fullenrich.com. The one served at help.fullenrich.com belongs to Intercom, the help-center host, not to FullEnrich. - id: hsts conforms: true evidence: >- HSTS enabled on all three hosts as of the 2026-08-14 probe — fullenrich.com and docs.fullenrich.com at max-age 63072000 (2 years), app.fullenrich.com at max-age 31536000 (1 year). app.fullenrich.com had no HSTS in the 2026-07-11 probe, so this was added between passes. See security/fullenrich-domain-security.yml. - id: caa conforms: false evidence: >- No CAA records published for fullenrich.com, so certificate issuance is not constrained to a chosen CA. DNSSEC, SPF and DMARC (p=quarantine) are all present. - id: e164 conforms: true evidence: Phone numbers are returned in E.164 with an ISO region code. compliance_programs: - id: soc2-type-2 status: certified evidence: >- "SOC2 Type 2 Certified" badge and FAQ text on https://fullenrich.com/trust; report available on request via the trust center. report_access: https://trust.delve.co/fullenrich - id: gdpr status: compliant evidence: >- Stated on https://fullenrich.com/trust and in the OpenAPI info.description. Article 32 measures enumerated (AES at rest, RBAC, HMAC-SHA256 signed JWT sessions, 1-year encrypted event logs, SCCs for transfers outside the EEA/UK). Publicly available DPA. 3-month enrichment data retention. - id: ccpa status: compliant evidence: '"CCPA compliant" badge on https://fullenrich.com/trust plus a "Do Not Sell My Information" flow.' - id: iso-27001 status: not-held-by-fullenrich evidence: >- ISO 27001 appears once on the trust page, describing DigitalOcean — the hosting sub-processor — as "compliant with SOC 2 and ISO 27001 standards". It is NOT a FullEnrich certification and must not be attributed to FullEnrich. - id: pentest status: performed evidence: '"FullEnrich is certified SOC 2 Type II and performs regular pentests."' data_residency: hosting_provider: DigitalOcean region: European Union transfers: Standard Contractual Clauses where data leaves the EEA/UK source: https://fullenrich.com/trust processing_role: waterfall_enrichment: processor detail: >- FullEnrich states it acts as data PROCESSOR for Waterfall Enrichment, processing only on the customer's instructions, and that the service uses and creates no database of enriched contacts.