generated: '2026-07-19'
method: derived
source: openapi/hakuna-openapi.yml
description: >-
  Cross-cutting standards conformance for the hakuna API, derived from the
  OpenAPI and documented conventions. No published compliance certifications
  (SOC 2 / ISO 27001 / etc.) were found, so no Compliance pointer is wired; the
  provider does state Swiss DSG data-protection compliance and Swiss data
  residency.
standards:
- id: oauth2
  conforms: false
  evidence: Auth is an API token (X-Auth-Token header), not OAuth2.
- id: openapi
  conforms: true
  evidence: OpenAPI 3.0 available at openapi/hakuna-openapi.yml (pipeline-generated from docs).
- id: rfc9457-problem-details
  conforms: false
  evidence: Errors are plain JSON objects with a `message` field, not application/problem+json.
- id: rfc6585-rate-limit
  conforms: true
  evidence: 429 responses with Retry-After and X-RateLimit-* headers.
- id: rest-json
  conforms: true
  evidence: JSON request/response REST API over HTTPS.
- id: swiss-dsg
  conforms: true
  evidence: Provider states 100% Swiss data residency and DSG data-protection compliance.