generated: '2026-08-13'
method: searched
source: https://www.northbeam.io/data-security
derived_from:
  - openapi/_original/northbeam-orders-v2-openapi.json
  - openapi/_original/northbeam-spend-v1-openapi.json
  - openapi/_original/northbeam-data-export-v1-openapi.json
  - well-known/northbeam-oauth-authorization-server.json
  - well-known/northbeam-oauth-protected-resource.json
  - well-known/northbeam-openid-configuration.json

standards:
  - id: openapi-3.1
    conforms: true
    evidence: >
      Three of four published documents declare openapi 3.1.0 (Orders v1, Orders v2,
      Spend v1); the Data Export document declares 3.0.0.
  - id: openapi-3.0
    conforms: true
    evidence: openapi/northbeam-data-export-v1-openapi.yml declares openapi 3.0.0
  - id: oauth2
    conforms: true
    scope: MCP agent surface only — the REST APIs are API-key authenticated
    evidence: >
      https://mcp.northbeam.io/.well-known/oauth-authorization-server (HTTP 200) declares
      grant_types_supported [authorization_code, refresh_token] and
      scopes_supported [access:mcp, offline_access].
  - id: oauth2-pkce
    conforms: true
    evidence: code_challenge_methods_supported ["S256"] in the MCP authorization-server metadata
  - id: rfc8414-authorization-server-metadata
    conforms: true
    evidence: https://mcp.northbeam.io/.well-known/oauth-authorization-server returns 200 JSON
  - id: rfc9728-protected-resource-metadata
    conforms: true
    evidence: >
      https://mcp.northbeam.io/.well-known/oauth-protected-resource returns 200 JSON with
      resource, authorization_servers, scopes_supported and bearer_methods_supported.
  - id: rfc7591-dynamic-client-registration
    conforms: true
    evidence: registration_endpoint https://mcp.northbeam.io/register in the MCP metadata
  - id: rfc6750-bearer-token
    conforms: true
    evidence: >
      401 responses from https://mcp.northbeam.io carry
      WWW-Authenticate: Bearer realm="https://mcp.northbeam.io", error="invalid_request",
      scope="access:mcp", resource_metadata="…/.well-known/oauth-protected-resource".
  - id: oidc
    conforms: true
    scope: end-user identity (Auth0 tenant), not the REST APIs
    evidence: https://auth.northbeam.io/.well-known/openid-configuration returns 200
  - id: mcp
    conforms: true
    evidence: >
      First-party remote MCP server at https://mcp.northbeam.io, documented as a custom
      connector for Claude and ChatGPT. Streamable HTTP transport.
    note: tools/list is bearer-gated, so the tool schema could not be verified anonymously
  - id: a2a
    conforms: false
    evidence: >
      /.well-known/agent-card.json and /.well-known/agent.json probed on six Northbeam
      hosts — 404 on api/www/docs/auth, 401 on mcp, 403 on api-uat. No agent card served.
  - id: rfc9457-problem-details
    conforms: false
    evidence: >
      No response in any spec declares application/problem+json. Three distinct proprietary
      error envelopes are published instead (see errors/northbeam-problem-types.yml).
  - id: rfc8594-sunset-header
    conforms: false
    evidence: >
      Orders v1 is titled "(Deprecated)" in its OpenAPI info.title but no Sunset or
      Deprecation header is documented and no removal date is published.
  - id: rfc9116-security-txt
    conforms: false
    evidence: /.well-known/security.txt returns 404 on api, www, auth and api-uat hosts
  - id: rfc6585-retry-after
    conforms: true
    evidence: >
      429 responses on the Orders API return a Retry-After header plus a
      retry_after_seconds body field (https://docs.northbeam.io/docs/orders-api-limits.md).
  - id: ratelimit-headers-draft
    conforms: false
    evidence: no X-RateLimit-* or RateLimit-* budget headers are documented or declared
  - id: idempotency-key-header
    conforms: false
    evidence: >
      No Idempotency-Key header. Idempotency is achieved structurally through natural-key
      upserts (order_id) — see conventions/northbeam-conventions.yml.
  - id: pagination
    conforms: false
    evidence: >
      No cursor, offset, page or Link-header pagination in any spec; GET /orders is bounded
      by start_date/end_date and bulk reads go through the async Data Export API.
  - id: json-api
    conforms: false
  - id: odata
    conforms: false
  - id: scim
    conforms: false
  - id: fhir
    conforms: false
  - id: graphql
    conforms: false
    evidence: no /graphql surface found on any Northbeam host
  - id: asyncapi
    conforms: false
    evidence: >
      No event, streaming or webhook surface is published. The only asynchronous pattern is
      submit-then-poll on the Data Export API.

compliance:
  published: true
  page: https://www.northbeam.io/data-security
  certifications:
    - name: SOC 2 Type 2
      status: certified
      evidence_quote: >
        "Northbeam is certified SOC 2 compliant… We are Soc 2 Type 2 compliant and our report
        is available upon request."
      report_access: on request (email)
      third_party_portal: none
  regulations:
    - name: GDPR
      page: https://www.northbeam.io/gdpr
    - name: Privacy Policy
      page: https://www.northbeam.io/privacy
    - name: Terms and Conditions
      page: https://www.northbeam.io/terms-conditions
  infrastructure:
    cloud: Google Cloud Platform
    tenancy: logically separated customer data
    identity: Auth0
    encryption: at rest and in transit, by default, for all customers
    source: https://www.northbeam.io/data-security