generated: '2026-07-19'
method: searched
source: https://knownwell.com/security/
also_derived_from: openapi/knownwell-ci-openapi-original.json
standards:
- id: openapi-3.1
  conforms: true
  evidence: 'openapi/knownwell-ci-openapi-original.json declares openapi: 3.1.0, served live at
    https://api.knownwell.com/ci/openapi.json'
- id: rest
  conforms: true
  evidence: 'Docs: "Our REST API is designed with resource-oriented URLs, JSON responses,
    standard HTTP methods, and secure API key authentication."'
- id: oauth2
  conforms: false
  evidence: 'Only an apiKey security scheme (X-API-Key header) is declared; no oauth2 flows.'
- id: oidc
  conforms: false
  evidence: No openIdConnect scheme and no /.well-known/openid-configuration (404).
- id: rfc9457-problem-details
  conforms: false
  evidence: 'Errors use a custom {error, detail, status_code} envelope, not
    application/problem+json.'
- id: rfc9116-security-txt
  conforms: false
  evidence: /.well-known/security.txt returns 404 on all Knownwell hosts.
- id: rfc8594-sunset-header
  conforms: false
  evidence: No deprecation or sunset policy published.
- id: pagination
  conforms: true
  evidence: 'Documented limit/offset pagination on list endpoints (default 100, max 500).'
- id: idempotency
  conforms: false
  evidence: 'Read-only API; no idempotency-key contract is published (all data operations are
    GET).'
- id: rate-limit-headers
  conforms: true
  evidence: 'X-RateLimit-Limit / X-RateLimit-Remaining / X-RateLimit-Reset on every response,
    429 on exceed.'
- id: json:api
  conforms: false
- id: scim2
  conforms: false
- id: odata
  conforms: false
- id: fhir-r4
  conforms: false
compliance:
  published: true
  page: https://knownwell.com/security/
  trust_center: https://trustcenter.knownwell.com
  certifications:
  - name: SOC 2
    status: Audited annually
  - name: Data Privacy Framework
    status: Active certification
    scope: EU, UK, and Switzerland
    source: https://knownwell.com/news/knownwell-achieves-data-privacy-framework-certification-across-eu-uk-and-switzerland/
  controls:
  - name: Penetration Testing
    status: Compliant — annual third-party
  - name: Continuous Monitoring
    status: Monitored — real-time controls
  data_handling:
  - Zero-retention AI inference — customer data is not used to train third-party models
  - PHI and PII are automatically redacted before storage
  - Customer data deleted upon account closure