generated: '2026-07-20'
method: searched
source: >-
  Derived from openapi/*.yml + asyncapi/*.yml and enriched from
  https://www.modulate.ai/compliance and https://docs.modulate.ai/faq
standards:
- id: openapi-3.1
  conforms: true
  evidence: All 11 batch specs are OpenAPI 3.1.0.
- id: asyncapi-3.0
  conforms: true
  evidence: All 7 streaming specs are AsyncAPI 3.0.0.
- id: api-key-auth
  conforms: true
  evidence: securitySchemes type apiKey (X-API-Key header) across all specs.
- id: oauth2
  conforms: false
  evidence: No oauth2 security schemes declared; authentication is API-key only.
- id: rfc9457-problem-details
  conforms: false
  evidence: Errors use a plain application/json ErrorResponse envelope, not application/problem+json.
- id: soc2
  conforms: true
  evidence: SOC 2 named on https://www.modulate.ai/compliance.
- id: iso-27001
  conforms: true
  evidence: ISO 27001 named on https://www.modulate.ai/compliance.
- id: gdpr
  conforms: true
  evidence: GDPR compliance, DPA and Standard Contractual Clauses documented (compliance page + FAQ privacy section).
- id: hipaa
  conforms: false
  evidence: PII/PHI redaction is offered as a capability, but no HIPAA certification is claimed on the compliance page.
compliance_program:
  url: https://www.modulate.ai/compliance
  certifications: [SOC 2, ISO 27001, GDPR]
  dpa: https://www.modulate.ai/privacy-policy