generated: '2026-07-19'
method: searched
source: https://www.immersivelabs.com/company/legal/security-and-privacy
standards:
- id: oidc
  conforms: true
  evidence: >-
    V1 GraphQL API exposes OIDC login operations (oidcLoginRequest query,
    oidcAttemptLoginRequest mutation) for SSO/OIDC provider sessions.
- id: graphql
  conforms: true
  evidence: V1 API is a GraphQL endpoint at api.immersivelabs.online/v1/graphql.
- id: oauth2
  conforms: false
  evidence: Auth is API-key -> bearer token exchange, not an OAuth2 authorization flow.
- id: soc2-type-ii
  conforms: true
  evidence: SOC 2 Type II report covering security, availability and confidentiality.
- id: iso-27001
  conforms: true
  evidence: ISO 27001 certified (UK Government-accredited, externally verified).
- id: cyber-essentials-plus
  conforms: true
  evidence: UK Cyber Essentials Plus (Government-accredited).
- id: gdpr
  conforms: true
  evidence: EU and UK GDPR compliance managed via OneTrust; CPRA/VCDPA/PIPEDA aligned.
- id: rfc9457-problem-details
  conforms: false