generated: '2026-07-19'
method: searched
source:
- https://developer.integrated.finance/docs/authentication
- https://integrated.finance/security-policy
standards:
- id: oauth2
  conforms: true
  evidence: OAuth 2.0 client-credentials flow with JWT client assertion (docs/authentication).
- id: oidc
  conforms: true
  evidence: Live OpenID Connect discovery document on Keycloak realm ifp (well-known/if-openid-configuration.json).
- id: open-banking
  conforms: true
  evidence: Open Banking Consents resource + consent lifecycle operations in the API reference.
- id: idempotency
  conforms: true
  evidence: X-Idempotency-Key supported on all POST endpoints (docs/idempotency-support).
- id: tls-1.2-plus
  conforms: true
  evidence: Docs require HTTPS with TLS v1.2 or above.
- id: pci-dss
  conforms: true
  evidence: Security policy states PCI DSS controls are embodied where appropriate.
- id: gdpr
  conforms: true
  evidence: Security policy cites GDPR / DPA 2018 (UK GDPR) protections and Standard Contractual Clauses.
- id: nist-csf
  conforms: true
  evidence: Information Security Policy mapped to NIST CSF and NIST 800-53 Rev 4 moderate baseline.
- id: rfc9457-problem-details
  conforms: false
  evidence: No application/problem+json error envelope documented.
- id: rfc8594-sunset
  conforms: false
  evidence: Deprecation/Sunset HTTP headers not supported; compatibility handled via new versions.
compliance_program:
  published: true
  url: https://integrated.finance/security-policy
  frameworks: [PCI DSS, GDPR / UK GDPR (DPA 2018), NIST CSF, NIST 800-53 Rev 4 moderate baseline]
  note: >-
    Frameworks are self-attested on the public security policy page; no third-party
    certification (SOC 2, ISO 27001) or regulatory licence is named publicly.