generated: '2026-08-26'
method: searched
source: >-
  https://muckrack.com/legal-and-security, https://muckrack.com/privacy,
  https://muckrack.com/blog/2022/06/27/soc2,
  https://www.businesswire.com/news/home/20220627005746/en/Muck-Rack-Completes-SOC-2-Certification,
  plus live probes of https://muckrack.com/api/ (2026-08-26)
note: >-
  Two kinds of claim are kept apart here. `certifications` are organizational
  compliance programs Muck Rack publishes on its own legal/security page and trust
  center. `standards` are protocol-level conformance assertions about the API itself,
  and every one of those is judged from OBSERVED behaviour — Muck Rack publishes no
  contract, so nothing here is inferred from a spec.
certifications:
- id: soc2-type-ii
  name: SOC 2 Type II
  conforms: true
  evidence: >-
    Completed a SOC 2 Type II examination audited by Sensiba San Filippo LLP via Vanta,
    announced 2022-06-27. Referenced as current on https://muckrack.com/legal-and-security
    and the report is offered through https://trust.muckrack.com/.
  source: https://muckrack.com/blog/2022/06/27/soc2
- id: gdpr
  name: GDPR
  conforms: true
  evidence: >-
    GDPR compliance and data-subject rights documented on https://muckrack.com/privacy;
    a Data Protection Addendum is published at https://muckrack.com/legal/l-dpa.
  source: https://muckrack.com/privacy
- id: ccpa-cpra
  name: CCPA / CPRA
  conforms: true
  evidence: California consumer-rights section published in the privacy policy.
  source: https://muckrack.com/privacy
- id: iso-27001
  name: ISO/IEC 27001
  conforms: false
  evidence: >-
    NOT claimed as a Muck Rack certification. ISO 27001 is named on the legal-and-security
    page only as a criterion Muck Rack applies when reviewing its own SUBPROCESSORS.
    Recorded explicitly so it is not mis-read as a Muck Rack certification.
  source: https://muckrack.com/legal-and-security
- id: csa-caiq-v4
  name: Cloud Security Alliance CAIQ v4
  conforms: true
  evidence: >-
    Pre-completed CAIQ v4 questionnaires are offered to customers under NDA per the
    legal-and-security page.
  source: https://muckrack.com/legal-and-security
- id: wcag
  name: WCAG / Section 508 / ETSI EN 301 549
  conforms: partial
  evidence: >-
    The platform is stated to be assessed against WCAG, US Section 508 and the European
    EN 301 549 accessibility standards. Conformance level and a VPAT are not published
    publicly, so this is recorded as partial rather than conformant.
  source: https://muckrack.com/legal-and-security
standards:
- id: oauth2
  conforms: false
  evidence: >-
    No OAuth surface. /.well-known/oauth-authorization-server is not served, and a Bearer
    credential is a static organization API key issued in the web app, not an OAuth token.
- id: oidc
  conforms: false
  evidence: /.well-known/openid-configuration is not served; no OIDC surface documented.
- id: rfc9457
  conforms: false
  evidence: >-
    Errors are the Django REST Framework default {"detail": "..."} with content type
    application/json. No type/title/status/instance members and no
    application/problem+json. Observed on live 403 responses.
- id: rfc9116
  name: security.txt
  conforms: false
  evidence: >-
    https://muckrack.com/.well-known/security.txt returns 404 at origin. A responsible
    disclosure policy IS published, but not at the RFC 9116 well-known location, so a
    machine cannot discover it. See security/muck-rack-vulnerability-disclosure.yml.
- id: rfc9727
  name: api-catalog
  conforms: false
  evidence: https://muckrack.com/.well-known/api-catalog returns 404 at origin.
- id: rfc8594
  name: Sunset / Deprecation headers
  conforms: unknown
  evidence: >-
    No Sunset or Deprecation header observed, but no deprecated operation was reachable
    anonymously to test against.
- id: idempotency
  conforms: na
  evidence: 'Read-only surface (Allow: GET, HEAD, OPTIONS); no unsafe method to protect.'
- id: pagination
  conforms: unknown
  evidence: Collection endpoint returns 403 before any payload; pagination style not observable.
- id: json-api
  conforms: false
  evidence: Response media type is application/json, not application/vnd.api+json.
- id: openapi
  conforms: false
  evidence: >-
    No OpenAPI or Swagger document is served at any probed location on muckrack.com or
    api.muckrack.com, and the customer-facing reference is behind authentication.
- id: asyncapi
  conforms: na
  evidence: >-
    No event, streaming or webhook surface exists. /api/webhooks/, /api/events/ and
    /api/subscriptions/ all 404. AsyncAPI is not applicable rather than missing.
domain_standard:
  applicable: false
  note: >-
    REWARD-ONLY check, deliberately left empty. The PR / earned-media measurement market
    has no adopted machine-readable interchange standard that Muck Rack's contract could
    declare — there is no SCIM/OData/OpenRTB/HL7/ISO-20022 equivalent for media coverage
    data. AMEC's Barcelona Principles and Integrated Evaluation Framework exist as
    measurement GUIDANCE for the sector but define no wire format, schema or identifier
    scheme, so they are not a domain standard a contract can conform to. Muck Rack is not
    penalised for the absence, and nothing is invented to fill the slot.
  candidates_considered:
  - id: amec-integrated-evaluation-framework
    is_wire_standard: false
    reason: Measurement methodology guidance; defines no schema, media type or identifier scheme.
  - id: iptc-ninjs
    is_wire_standard: true
    conforms: unknown
    reason: >-
      IPTC ninjs is the news-industry JSON standard for news items and would be the
      plausible domain standard for article payloads. Muck Rack's article payload is not
      publicly observable, so conformance cannot be established either way. Recorded as a
      lead for a future authenticated review, NOT as a conformance claim.