generated: '2026-07-19'
method: derived
source: openapi/lightning-social-ventures-lightning-reach-openapi.json
notes: >-
  Standards conformance derived from the published OpenAPI and from live
  response headers observed 2026-07-19. Lightning Reach publishes no compliance
  or certification page (probe-security-programs.py found no trust centre and no
  vulnerability-disclosure programme), so NO `Compliance` pointer is emitted —
  only asserted standards are recorded here.
standards:
  - id: openapi-3.0
    conforms: true
    evidence: served OpenAPI 3.0.0 document at https://api.lightningreach.org/docs
  - id: w3c-trace-context
    conforms: true
    evidence: responses carry a `traceparent` header in the 00-<trace>-<span>-01 form
  - id: rfc6797-hsts
    conforms: true
    evidence: 'strict-transport-security: max-age=31536000; includeSubDomains on api.lightningreach.org'
  - id: iso8601-timestamps
    conforms: true
    evidence: all date-time fields use format date-time; filters documented as "ISO 8601 timestamp"
  - id: rfc9457-problem-details
    conforms: false
    evidence: errors use the NestJS {statusCode, message} envelope, not application/problem+json
  - id: oauth2
    conforms: false
    evidence: no oauth2 securityScheme in the OpenAPI
  - id: oidc
    conforms: false
    evidence: no openid-configuration published; /.well-known/openid-configuration returns 400/401
  - id: rfc9116-security-txt
    conforms: false
    evidence: no /.well-known/security.txt on any host
  - id: rfc8594-sunset-header
    conforms: false
    evidence: no deprecation policy or Sunset header documented
  - id: json-api
    conforms: false
    evidence: bespoke JSON envelopes, not JSON:API media type
  - id: asyncapi
    conforms: false
    evidence: no AsyncAPI document published (webhook surface exists — see asyncapi/)
  - id: idempotency-key
    conforms: false
    evidence: no Idempotency-Key header or parameter in the spec
regulatory_context:
  jurisdiction: United Kingdom
  note: >-
    The platform processes personal financial-hardship data for UK councils,
    housing associations, charities and utilities, which places it in scope of
    UK GDPR / Data Protection Act 2018. Lightning Reach publishes a privacy
    policy, but publishes no certification (SOC 2 / ISO 27001) evidence that
    could be verified, so none is claimed here.
  privacy_policy: https://www.lightningreach.org/privacy-policy
certifications_published: []