generated: '2026-08-22' method: derived source: openapi/ (7 derived specs) + live responses from https://group14.technology/wp-json/ description: >- Cross-cutting standards assertions for the machine-readable surface behind group14.technology. Group14 publishes no compliance claims for API access of any kind — no SOC 2, no ISO 27001, no trust center, no certifications page — so NO `Compliance` pointer is emitted in apis.yml. standards: - id: openapi-3.1 conforms: true evidence: 'openapi/ contains 7 OpenAPI 3.1.0 documents, 31 operations, derived from the server''s own OPTIONS schema documents. Derived by API Evangelist — Group14 publishes no OpenAPI.' published_by_provider: false - id: json-schema-2020-12 conforms: true evidence: 'The WordPress REST API serves per-route JSON Schema through HTTP OPTIONS; each document carries "$schema": "http://json-schema.org/draft-04/schema#". The schemas in openapi/ were lifted from those documents.' published_by_provider: true note: 'Draft-04 as served, normalized into 2020-12-compatible shapes for OpenAPI 3.1.' - id: rfc9457 conforms: false evidence: 'Errors use the WordPress envelope {code,message,data.status} served as application/json, not application/problem+json. See errors/group14-technologies-problem-types.yml.' - id: pagination conforms: true evidence: 'Page-number pagination with page/per_page/offset, plus X-WP-Total and X-WP-TotalPages response headers and RFC 8288 Link rel="next"/"prev". Observed live: X-WP-Total: 169 on /wp/v2/resource.' - id: rfc8288-web-linking conforms: true evidence: 'Link: ; rel="next" observed on collection responses. Records also carry HAL-style _links.' - id: idempotency conforms: false evidence: No Idempotency-Key support. Public surface is read-only; see conventions/. - id: oauth2 conforms: false evidence: 'No OAuth. /.well-known/oauth-authorization-server and /.well-known/oauth-protected-resource both 404.' - id: oidc conforms: false evidence: /.well-known/openid-configuration returns 404. - id: rfc9116-security-txt conforms: false evidence: '/.well-known/security.txt returns 404 (548-byte plain nginx 404).' - id: rfc8615-well-known conforms: false evidence: 'Every /.well-known/ path probed returned 404. See well-known/group14-technologies-well-known.yml.' - id: oembed-1.0 conforms: true evidence: 'The site registers the oembed/1.0 namespace with /oembed/1.0/embed and /oembed/1.0/proxy, declared in its own route index at https://group14.technology/wp-json/.' published_by_provider: true - id: schema-org-json-ld conforms: true evidence: 'Yoast SEO v28.2 emits a schema.org JSON-LD @graph on every page, and exposes it machine-readably through /wp-json/yoast/v1/get_head. The provider-published /llms.txt is generated by the same plugin.' published_by_provider: true - id: llms-txt conforms: true evidence: 'https://group14.technology/llms.txt returns 200 with a real llms.txt document (Yoast SEO v28.2 generated). Saved verbatim to llms/group14-technologies-llms.txt.' published_by_provider: true - id: mcp conforms: partial evidence: >- A WordPress MCP Adapter endpoint is registered at /wp-json/mcp/mcp-adapter-default-server and declared in the site's own REST index, but tools/list returns 401 anonymously so protocol conformance cannot be verified. See mcp/group14-technologies-mcp.yml. domain_standards: assessed: true applicable: [] detail: >- Group14's market is battery active materials manufacturing and its regulated counterparties are cell makers and automotive OEMs. The relevant industry data standards in that space — the Global Battery Alliance Battery Passport, the EU Battery Regulation digital product passport, IPC-1752A / IEC 62474 materials declarations, and EDI/EDIFACT supply-chain messaging — govern material declarations and supply-chain documents, not web content APIs. NONE of them appear anywhere in this contract, and none would be expected to: the only machine-readable surface Group14 exposes is the WordPress content API behind its marketing site. No domain standard is asserted. This is a reward-only dimension and an honest empty list, not a failure. probed_for: - {standard: 'GBA Battery Passport', found: false, note: No battery passport, DPP or material-declaration endpoint on any probed host.} - {standard: 'EU Battery Regulation DPP', found: false, note: No digital product passport surface.} - {standard: 'IEC 62474 / IPC-1752A material declaration', found: false, note: No materials-declaration endpoint or schema.} - {standard: 'EDIFACT / X12 supply chain', found: false, note: No EDI surface exposed publicly.} compliance_certifications: published: - standard: ISO 9001 scope: Quality management system, manufacturing announced: '2023-04-12' evidence: https://group14.technology/resources/press-releases/group14-technologies-fortifies-global-manufacturing-roadmap-for-silicon-battery-materials-with-iso-9001-certification/ evidence_status: 200 note: >- A real, provider-published certification, announced by press release and discoverable through the resource library. READ IT FOR WHAT IT IS: ISO 9001 certifies the manufacturing quality management system that Group14's cell-maker and automotive customers require. It says nothing about information security, data handling or the API surface, and it must not be read as an API compliance posture. not_published: - SOC 2 - ISO 27001 - IATF 16949 - PCI DSS - HIPAA - FedRAMP detail: >- ISO 9001 is the only certification Group14 publishes. No information-security certification of any kind was found. There is no trust center: trust.group14.technology is NXDOMAIN and /security/, /trust/, /certifications/ and /quality/ all return 404, so NO `TrustCenter` pointer is emitted. A `Compliance` pointer IS emitted, on the strength of the ISO 9001 announcement alone, with the scope caveat above attached. probe_method: >- Searched the provider's own content surface for ISO, certification, SOC 2, compliance, security and quality via /wp/v2/search, and probed the conventional trust-center hosts and paths directly.