generated: '2026-07-20'
method: searched
source: https://dev.proof.com/docs
standards:
  - id: oauth2
    conforms: true
    evidence: OAuth 2.0 client_credentials grant at https://api.proof.com/oauth/v2/token (docs/oauth-client-credentials).
  - id: oidc-discovery
    conforms: true
    evidence: /.well-known/openid-configuration published at api.proof.com (issuer/token_endpoint/jwks_uri).
  - id: openid4vp
    conforms: true
    evidence: Digital Credentials verification via OID4VP (docs/verify-a-credential) - build a presentation request, receive vp_token, validate.
  - id: openid4vci
    conforms: false
    evidence: OID4VCI credential issuance documented as "Coming Soon".
  - id: sd-jwt-vc
    conforms: true
    evidence: Verifiable Credentials use SD-JWT VC format (RFC 9901 + SD-JWT VC draft 16) per docs/sd-jwt-vc-format.
  - id: hmac-webhook-signing
    conforms: true
    evidence: Webhooks signed with HMAC-SHA256 in the X-Notarize-Signature header.
  - id: rfc9457-problem-details
    conforms: false
    evidence: Errors returned as {"errors":[...]} string array, not application/problem+json.
  - id: rfc8594-sunset-header
    conforms: false
    evidence: No documented Sunset/Deprecation header support.
  - id: soc2
    conforms: true
    evidence: SOC 2 published on the Proof security portal (security.proof.com).
  - id: iso-27001
    conforms: true
    evidence: ISO 27001 published on the Proof security portal.
  - id: hipaa
    conforms: true
    evidence: HIPAA published on the Proof security portal.
  - id: pci-dss
    conforms: true
    evidence: PCI DSS published on the Proof security portal.
  - id: fedramp
    conforms: true
    evidence: FedRAMP referenced on the Proof security portal.
  - id: gdpr
    conforms: true
    evidence: GDPR referenced on the Proof security portal.
  - id: ccpa
    conforms: true
    evidence: CCPA referenced on the Proof security portal.