generated: '2026-07-19'
method: searched
source: https://useklump.com and https://docs.useklump.com
standards:
- id: pci-dss
  conforms: true
  evidence: Klump publishes a "PCI DSS Compliant" badge in the footer of useklump.com
    (/images/pci-dss-compliant.png). No certificate, attestation of compliance, level,
    or assessor is published.
  confidence: claimed-by-provider
- id: oauth2
  conforms: false
  evidence: No OAuth surface. Authentication is a merchant secret key sent in a
    klump-secret-key header.
- id: oidc
  conforms: false
  evidence: No /.well-known/openid-configuration on any Klump host.
- id: rfc9457-problem-details
  conforms: false
  evidence: Errors are plain HTTP status codes with a code and message body; no
    application/problem+json is published.
- id: rfc9116-security-txt
  conforms: false
  evidence: No /.well-known/security.txt on useklump.com, api.useklump.com, or
    docs.useklump.com.
- id: rfc9727-api-catalog
  conforms: false
  evidence: No /.well-known/api-catalog on any Klump host.
- id: rfc8594-sunset-header
  conforms: false
  evidence: No deprecation or sunset policy published.
- id: hmac-webhook-signing
  conforms: true
  evidence: Every webhook delivery carries an X-Klump-Signature HMAC of the request
    body, with published JavaScript and PHP verification samples.
- id: idempotent-event-delivery
  conforms: true
  evidence: Webhook deliveries are at-least-once with a retry-stable X-Klump-Webhook-Id
    deduplication key and explicit merchant idempotency guidance.
- id: openapi
  conforms: false
  evidence: Klump publishes no OpenAPI or Swagger definition; probes of
    /openapi.json and /swagger.json on api.useklump.com and docs.useklump.com return
    404.
- id: asyncapi
  conforms: false
  evidence: Klump documents webhooks but publishes no AsyncAPI document.
regulatory:
- jurisdiction: Nigeria
  note: Klump Technology Company Ltd is a Nigerian consumer-credit/BNPL provider. No
    regulator licence number, CBN licence reference, NDPR registration, SOC 2, or ISO
    27001 certification is published on the public site, so none is asserted here.
compliance_page: https://useklump.com
notes: Only the PCI DSS badge constitutes a published compliance claim; it is
  recorded as claimed-by-provider rather than verified. No trust center exists.