generated: '2026-08-23'
method: searched
source: https://resources.insidesales.com/commitment-to-gdpr-compliance/
note: >-
  No machine-readable contract exists for this provider, so nothing below is derived from a spec.
  Every assertion is read from the company's own published pages, and every `false` means the
  provider does not claim it — not that we failed to look.
standards:
- id: openapi
  conforms: false
  evidence: >-
    No OpenAPI/Swagger document at any host. Probed 2026-08-23: /openapi.json, /swagger.json,
    /openapi.yaml, /api-docs, /v2/api-docs, /docs, /redoc on www., helpcenter., resources.,
    status. and on the three API hosts named in the docs (all three of which fail DNS).
- id: asyncapi
  conforms: false
  evidence: No event, streaming or webhook surface is documented; a help-center search for "webhook" returns no article.
- id: graphql
  conforms: false
  evidence: No /graphql endpoint on any resolvable host.
- id: grpc-protobuf
  conforms: false
  evidence: No .proto published in the InsideSalesOfficial GitHub org or on buf.build.
- id: wsdl-soap
  conforms: false
  evidence: No ?wsdl / ?singleWsdl surface; no SOAP or enterprise-integration contract referenced in the docs.
- id: mcp
  conforms: false
  evidence: No MCP server published, hosted or stdio.
- id: a2a-agent-card
  conforms: false
  evidence: /.well-known/agent-card.json and /.well-known/agent.json return 404 on all four live hosts.
- id: oauth2
  conforms: false
  evidence: >-
    Authentication is a static administrator-minted access key. No authorization server, no
    /.well-known/oauth-authorization-server, no documented flows or scopes.
- id: oidc
  conforms: false
  evidence: /.well-known/openid-configuration returns 404 on all four live hosts.
- id: rfc9457-problem-details
  conforms: false
  evidence: No error contract of any kind is published.
- id: rfc9116-security-txt
  conforms: false
  evidence: >-
    /.well-known/security.txt 404s on www., helpcenter. and resources. The 200 on
    status.insidesales.com is Atlassian's own security.txt served by the hosted Statuspage platform
    (Canonical https://www.atlassian.com/.well-known/security.txt), not InsideSales'.
- id: rfc8594-sunset-header
  conforms: false
  evidence: No deprecation or sunset policy is published — see lifecycle/insidesales-com-lifecycle.yml.
- id: gdpr
  conforms: true
  evidence: >-
    First-party published commitment at https://resources.insidesales.com/commitment-to-gdpr-compliance/
    (HTTP 200, probed 2026-08-23): "We comply with the GDPR in the delivery of our products and
    services to our customers" and "We have reviewed the requirements of the GDPR and have made
    enhancements to our products, contracts and documentation in order to support compliance with
    GDPR for InsideSales and our customers." This is a self-declared compliance commitment, not an
    audited certification.
- id: soc2
  conforms: false
  evidence: >-
    Third-party summaries assert InsideSales is SOC 2 certified, but NO first-party page states it.
    Probed 2026-08-23: /security/, /trust/, /soc-2/ and trust.insidesales.com all fail
    (404, soft-404 redirect to home, 404, DNS failure). Recorded false because there is no
    provider-published evidence — not because the certification necessarily does not exist.
domain_standards:
  market: sales engagement / CRM-attached telephony
  note: >-
    REWARD-ONLY dimension, and this market has no dominant machine-readable interchange standard for
    the sales-engagement layer itself, so nothing is asserted. The product's own integration
    contracts are consumed against Salesforce and Microsoft Dynamics platform APIs rather than
    declared in a shared standard, and none of SCIM, OData, OpenRTB, HL7, X12, ISO 20022, LTI or
    ActivityPub has any signature anywhere in the public surface.
  declared: []
compliance_program:
  published: true
  url: https://resources.insidesales.com/commitment-to-gdpr-compliance/
  certifications: []
  note: >-
    A GDPR commitment page is published and is the basis for the `Compliance` pointer in apis.yml.
    No named certification (SOC 2, ISO 27001, PCI DSS, HIPAA, FedRAMP) is published first-party, and
    no trust center exists, so no `TrustCenter` pointer is emitted.