generated: '2026-08-13' method: searched source: >- https://learn.microsoft.com/en-us/clarity/faq, https://learn.microsoft.com/en-us/clarity/setup-and-installation/clarity-data-export-api, https://www.microsoft.com/.well-known/security.txt, and openapi/microsoft-clarity-dataexport-api-openapi.yml provider: Microsoft Clarity providerId: microsoft-clarity description: >- Cross-cutting standards and regulatory posture for Microsoft Clarity. The privacy-regulation side is strong and published in the provider's own words; the API-standards side is almost entirely absent, which is consistent with a one-operation export endpoint. standards: - id: rfc6750 name: OAuth 2.0 Bearer Token Usage conforms: true evidence: >- Credentials are presented as `Authorization: Bearer ` and the OpenAPI declares securityScheme type http, scheme bearer, bearerFormat JWT. The bearer PRESENTATION follows RFC 6750 even though no OAuth authorization server is involved — the token is minted in the Clarity dashboard. source: https://learn.microsoft.com/en-us/clarity/setup-and-installation/clarity-data-export-api - id: jwt name: JSON Web Token (RFC 7519) conforms: true evidence: >- Clarity documents the access token as a JWT and links its own glossary entry for JWT; the OpenAPI records bearerFormat: JWT. source: https://learn.microsoft.com/en-us/clarity/setup-and-installation/clarity-data-export-api - id: oauth2 name: OAuth 2.0 authorization framework conforms: false evidence: >- No authorization server, no /.well-known/oauth-authorization-server (404 on www.clarity.ms, SPA shell on clarity.microsoft.com), no scopes, no grant types. Tokens are long-lived project credentials generated in the dashboard by an admin. - id: oidc name: OpenID Connect conforms: false evidence: >- /.well-known/openid-configuration probed 2026-08-13 — 404 on www.clarity.ms and www.microsoft.com; HTML SPA shell on clarity.microsoft.com. - id: rfc9457 name: Problem Details for HTTP APIs conforms: false evidence: >- No application/problem+json media type and no documented error body. The published error table names status codes and reason phrases only. See errors/microsoft-clarity-problem-types.yml. - id: pagination name: Result pagination conforms: false evidence: >- Explicitly unsupported: "The response is limited to 1,000 rows and can't be paginated." source: https://learn.microsoft.com/en-us/clarity/setup-and-installation/clarity-data-export-api - id: idempotency name: Idempotency keys conforms: false evidence: >- No Idempotency-Key facility. The single published operation is a GET, so it is idempotent by HTTP method, but no key-based replay contract exists. - id: rate-limit-headers name: RateLimit header fields for HTTP conforms: false evidence: >- No RateLimit-*, X-RateLimit-* or Retry-After headers are documented, even though a 429 is a documented outcome of a 10-requests-per-day quota. - id: rfc8594 name: The Sunset HTTP Header Field conforms: false evidence: No Sunset or Deprecation headers documented for any operation. - id: rfc9116 name: security.txt conforms: true scope: parent-domain evidence: >- Probed 2026-08-13: https://www.microsoft.com/.well-known/security.txt returns HTTP 200 text/plain with Contact, Policy, Acknowledgments, Encryption, Canonical, Expires (2026-09-23) and CSAF fields. Clarity's own hosts (www.clarity.ms, clarity.microsoft.com) serve none; this is Microsoft Corporation's corporate file, which covers Clarity as a Microsoft product. source: https://www.microsoft.com/.well-known/security.txt - id: mcp name: Model Context Protocol conforms: true evidence: >- Microsoft publishes a first-party MCP server, @microsoft/clarity-mcp-server, documented on Microsoft Learn. Local stdio transport only; no hosted endpoint. See mcp/microsoft-clarity-mcp.yml. source: https://learn.microsoft.com/en-us/clarity/third-party-integrations/clarity-mcp-server - id: a2a name: Agent2Agent Protocol conforms: false evidence: >- No agent card. /.well-known/agent-card.json and /.well-known/agent.json probed 2026-08-13 on www.clarity.ms (404), learn.microsoft.com (404), www.microsoft.com (404) and clarity.microsoft.com (HTTP 200 HTML SPA shell, not an AgentCard). compliance: published: true programs: - id: gdpr name: General Data Protection Regulation conforms: true role: data controller evidence: >- Clarity FAQ, "Is Clarity GDPR compliant?": "Clarity is GDPR-compliant as a data controller." source: https://learn.microsoft.com/en-us/clarity/faq - id: ccpa name: California Consumer Privacy Act conforms: true evidence: >- Clarity FAQ: "Clarity processes data in compliance with the CCPA." source: https://learn.microsoft.com/en-us/clarity/faq - id: eu-data-transfer name: EU cross-border transfer (SCCs) conforms: true evidence: >- Clarity FAQ: EU customers contract with Microsoft Ireland Operations Limited, which holds Standard Contractual Clauses with Microsoft Corporation permitting affiliate cross-border transfer. source: https://learn.microsoft.com/en-us/clarity/faq - id: consent-enforcement name: EEA/UK/Switzerland consent signal enforcement conforms: true evidence: >- Clarity enforces a consent signal for end users in the EEA, UK and Switzerland; webmasters must convey consent status through the Clarity client API or collection is limited in those regions. source: https://learn.microsoft.com/en-us/clarity/faq - id: age-restriction name: Under-18 use restriction conforms: true evidence: >- Published constraint on the client API reference: "Clarity shouldn't be used on any websites/apps targeting users under the age of 18." source: https://learn.microsoft.com/en-us/clarity/setup-and-installation/clarity-api certifications_note: >- No Clarity-scoped SOC 2, ISO 27001, PCI DSS, HIPAA or FedRAMP attestation was found on any Clarity page, and the security-programs probe found no Clarity trust center. Microsoft Corporation publishes certifications through the Microsoft Trust Center, but none was located that names Clarity in scope, so none is claimed here. maintainers: - FN: Kin Lane email: kin@apievangelist.com