generated: '2026-07-19'
method: searched
source: https://homebot.ai/trust-compliance
note: >-
  Homebot does not publish a public OpenAPI. Standards below are asserted from the
  Trust & Compliance page and from observed behavior of the customer authentication flow
  (OAuth 2.0 authorization-code parameters on the login redirect). API-level standards
  (RFC 9457, JSON:API, pagination) are unverified because the Open API is gated behind a
  request-access form.
standards:
- id: soc2-type2
  conforms: true
  evidence: SOC 2 Type 2 since 2021; annual audit (Security + Privacy). https://homebot.ai/trust-compliance
- id: ccpa-cpra
  conforms: true
  evidence: Privacy program aligned with CCPA/CPRA. https://homebot.ai/trust-compliance
- id: glba
  conforms: true
  evidence: GLBA safeguards program. https://homebot.ai/trust-compliance
- id: respa
  conforms: true
  evidence: RESPA compliance confirmed by outside-counsel opinion letter.
- id: can-spam
  conforms: true
  evidence: CAN-SPAM opt-out mechanisms in outbound email.
- id: oauth2
  conforms: true
  evidence: Client portal login uses OAuth 2.0 authorization-code flow (client_id, redirect_uri, state params on customer-admin.homebotapp.com/auth/callback).
- id: rfc9457-problem-details
  conforms: false
  evidence: Not verified; no public API spec.
- id: json-api
  conforms: false
  evidence: Not verified; org maintains jsonapi.rb tooling but the Open API is not published.