generated: '2026-08-01'
method: searched
source: https://morningconsult.com/security
derived_from: openapi/morning-consult-openapi-original.yml
standards:
- id: openapi-3.0
  conforms: true
  evidence: 'openapi: 3.0.3 served verbatim at https://api.morningconsult.com/openapi.yaml'
- id: oauth2
  conforms: false
  evidence: >-
    No oauth2 securityScheme. Authentication is an HTTP Basic credential exchange that
    mints a JWT bearer token plus a refresh token — an OAuth-shaped flow, but not the
    OAuth 2.0 protocol and not advertised as such.
- id: oidc
  conforms: false
  evidence: No openIdConnect scheme and no /.well-known/openid-configuration (404).
- id: rfc7519-jwt
  conforms: true
  evidence: securityScheme JWT is http/bearer with bearerFormat JWT; POST /auth/token
    returns id_token + refresh_token + expires_in + token_type Bearer.
- id: rfc9457-problem-details
  conforms: false
  evidence: >-
    Errors use a custom application/json envelope {code, status, errors[]}; no
    application/problem+json media type appears anywhere in the spec.
- id: rfc9116-security-txt
  conforms: false
  evidence: /.well-known/security.txt returns 404 on every host, although a disclosure
    policy IS published at https://morningconsult.com/security.
- id: rfc8594-sunset-header
  conforms: false
  evidence: >-
    Deprecation is published as a dated policy (sunset 2026-10-01) and as
    `deprecated: true` on 11 operations, but no Sunset or Deprecation response header is
    documented or declared.
- id: rfc9727-api-catalog
  conforms: false
  evidence: /.well-known/api-catalog returns 404.
- id: cursor-pagination
  conforms: true
  evidence: Opaque base64 pagination_token cursor with page_size (default 50, max 100),
    echoed on the response.
- id: idempotency
  conforms: false
  evidence: No idempotency key header or parameter is documented or present in the spec.
- id: json-api
  conforms: false
  evidence: Plain JSON payloads; no JSON:API document structure or media type.
- id: asyncapi
  conforms: false
  evidence: No event, streaming or webhook surface — bulk jobs are submit-then-poll.
- id: mcp
  conforms: false
  evidence: No hosted or published Model Context Protocol server found.
- id: a2a
  conforms: false
  evidence: /.well-known/agent-card.json and /.well-known/agent.json return 404 on every
    host.
- id: llms-txt
  conforms: true
  evidence: https://morningconsult.com/llms.txt returns 200 with a real llms.txt
    document.
compliance:
  published: true
  page: https://morningconsult.com/security
  trust_center: https://trust.morningconsult.com/
  programs:
  - id: soc2-type-ii
    name: SOC 2 Type II
    status: certified
    detail: Information security program aligned with the AICPA SOC 2 framework across
      all five Trust Services Criteria, audited annually.
    evidence: https://morningconsult.com/security
  - id: gdpr
    name: GDPR
    status: compliant
    evidence: https://morningconsult.com/security
  - id: ccpa
    name: CCPA
    status: compliant
    evidence: https://morningconsult.com/security
  - id: iso-27001
    name: ISO 27001
    status: inherited
    detail: Named as a control of the underlying AWS infrastructure rather than a
      Morning Consult corporate certification.
    evidence: https://morningconsult.com/security
  - id: iso-27017
    name: ISO 27017
    status: inherited
    detail: Named as an AWS infrastructure control.
    evidence: https://morningconsult.com/security
  controls:
  - Data in transit over HTTPS with TLS 1.2 / 1.3
  - Data at rest encrypted with AES-256
  - SSO via SAML 2.0