generated: '2026-07-19'
method: searched
source: https://light.inc/security
sources:
- https://light.inc/security
- https://docs.light.inc/getting-started/authentication
- openapi/light-openapi-original.json

standards:
- id: openapi-3.0
  conforms: true
  evidence: 'openapi/light-openapi-original.json declares openapi 3.0.1'
- id: rest
  conforms: true
  evidence: >-
    Docs state the API is organized around REST and uses standard HTTP response codes,
    authentication and verbs.
- id: oauth2
  conforms: true
  evidence: >-
    Documented OAuth 2.0 authorization-code flow with authorize/token endpoints, state
    parameter and refresh-token rotation.
  docs: https://docs.light.inc/getting-started/authentication
- id: rfc6749-oauth2-authorization-code
  conforms: true
  evidence: Docs link RFC 6749 section 4.1.1 for the state parameter.
- id: rfc6750-bearer-token
  conforms: true
  evidence: 'Access tokens presented as Authorization: Bearer; bearerFormat JWT in the spec.'
- id: http-basic-auth
  conforms: true
  evidence: 'API keys sent as Authorization: Basic <api_key>.'
- id: rfc9457-problem-details
  conforms: false
  evidence: >-
    Errors use a custom envelope {name, type, errors[]}; no application/problem+json media type
    appears anywhere in the spec.
- id: rfc8594-sunset-header
  conforms: false
  evidence: No Sunset or Deprecation header support documented; no published deprecation policy.
- id: openidconnect
  conforms: false
  evidence: No /.well-known/openid-configuration (404 on api.light.inc, light.inc, docs.light.inc).
- id: rfc8414-oauth-authorization-server-metadata
  conforms: false
  evidence: /.well-known/oauth-authorization-server returns 404 on all probed hosts.
- id: rfc9116-security-txt
  conforms: false
  evidence: /.well-known/security.txt returns 404 on all probed hosts.
- id: idempotency-key
  conforms: partial
  evidence: >-
    An X-Idempotency-Key request header is accepted on 14 write operations, but not on all
    write operations, and it is not the IETF-draft Idempotency-Key header name.
  reference: conventions/light-conventions.yml
- id: cursor-pagination
  conforms: true
  evidence: cursor/limit/offset query parameters on 22 list operations with a paginated response envelope.
- id: json-camelcase
  conforms: true
  evidence: Docs state most endpoints accept and return JSON-encoded data in camelCase.
- id: asyncapi
  conforms: false
  evidence: No event, streaming or webhook surface is documented; not applicable.

compliance_program:
  published: true
  page: https://light.inc/security
  certifications:
  - name: SOC 2 Type II
    scope: Light
    url: https://light.inc/soc-2
    evidence: >-
      "Light is SOC 2 Type II compliant, meaning that the way we process and store client data
      is secure and protected, based on standards set by the AICPA."
  - name: SOC 1 Type II
    scope: Light
    url: https://light.inc/soc-1
    evidence: Listed as "SOC 1, Type 2" in the site compliance footer.
  - name: SOX / Sarbanes-Oxley
    scope: Light
    url: https://light.inc/sox-compliance
    evidence: Dedicated "Sarbanes-Oxley Act & SOX compliance" page.
  regulatory:
  - name: GDPR
    url: https://light.inc/gdpr
    evidence: '"Compliant with GDPR (& CCPA)" on the security page; dedicated GDPR page.'
  - name: CCPA
    evidence: Stated alongside GDPR on the security page.
  - name: DPA
    url: https://light.inc/dpa
    evidence: Data Processing Agreement published.
  vendor_scoped_claims:
    note: >-
      IMPORTANT — the following are claims about Light's INFRASTRUCTURE PROVIDERS, not Light's
      own certifications. Recorded separately so they are not misread as Light certifications.
    claims:
    - standard: ISO 27001
      scope: cloud providers
      evidence: >-
        "we ... only work with cloud providers whose data centers are SOC 2 and ISO 27001 certified"
    - standard: ISO (unspecified)
      scope: servers
      evidence: '"All Light servers are ISO-certified." — certification body/standard not named.'
    - standard: HIPAA
      scope: AWS deployment
      evidence: '"Our own core backend application is located in our HIPAA-compliant AWS deployment."'
    - standard: PCI
      scope: AWS Secrets Manager
      evidence: >-
        "The secrets we store with enterprise-grade AWS Secrets Manager which is both PCI and
        SOC 2 compliant."