generated: '2026-08-12'
method: searched
source: https://groupboss.io/privacy-policy
note: >-
  Recorded absence, not an unchecked file. Groupboss publishes no public API, so
  every API-contract standard below is not-applicable rather than failed. Its
  privacy policy names no compliance regime and no certification, so NO Compliance
  and NO TrustCenter pointer is emitted — the only security statement published is
  the prose claim "Hosted on high performing Secure Enterprise Level clouds".
applicability: no-public-api
standards:
- id: openapi
  conforms: false
  applicable: false
  evidence: >-
    No OpenAPI/Swagger document at any host. Probed /openapi.json, /openapi.yaml,
    /swagger.json, /v1/openapi.json, /api-docs, /docs, /redoc on groupboss.io,
    app.groupboss.io, api.groupboss.com and support.groupboss.io.
- id: graphql
  conforms: false
  applicable: false
  evidence: /graphql returns the catch-all HTML shell on every host; no GraphQL surface.
- id: asyncapi
  conforms: false
  applicable: false
  evidence: No event, streaming or webhook surface is published.
- id: oauth2
  conforms: false
  applicable: false
  evidence: >-
    /.well-known/oauth-authorization-server returns 404. Groupboss authenticates
    users with an email/password account on app.groupboss.io; it does not issue
    OAuth tokens to third parties.
- id: oidc
  conforms: false
  applicable: false
  evidence: /.well-known/openid-configuration returns 404 on groupboss.io.
- id: rfc9457
  conforms: false
  applicable: false
  evidence: No API, therefore no problem+json error envelope.
- id: rfc9116
  conforms: false
  applicable: true
  evidence: /.well-known/security.txt returns 404 on groupboss.io and support.groupboss.io.
- id: rfc8615
  conforms: false
  applicable: true
  evidence: >-
    No document is served from any /.well-known/ path. See
    well-known/groupboss-well-known.yml.
- id: gdpr
  conforms: unknown
  applicable: true
  evidence: >-
    The privacy policy does not mention GDPR, a data processing agreement, or
    sub-processors. Data retention is stated only as "1 month to 3 years or more"
    and "subject to change".
- id: soc2
  conforms: false
  applicable: true
  evidence: No SOC 2 report or trust center is published; no certification is named.
- id: iso27001
  conforms: false
  applicable: true
  evidence: No ISO 27001 certification is named anywhere on the public site.
certifications_published: []
trust_center: null
x-evidence:
- url: https://groupboss.io/privacy-policy
  status: 200
  fetched: '2026-08-12'
- url: https://groupboss.io/faq
  status: 200
  fetched: '2026-08-12'
- url: https://groupboss.io/.well-known/security.txt
  status: 404
  fetched: '2026-08-12'