generated: '2026-07-20'
method: searched
source: https://ontic.co/company/trust-and-security
note: >-
  Ontic is a closed corporate/physical security management SaaS platform with no
  public developer API surface; conformance here reflects published organizational
  security and compliance programs rather than API-protocol standards derived from
  an OpenAPI definition.
standards:
- id: soc2
  conforms: true
  evidence: Annual SOC 2 audit; report available to clients (trust-and-security page)
- id: iso27001
  conforms: true
  evidence: ISO 27001 Certified (trust-and-security page)
- id: csa-star-1
  conforms: true
  evidence: CSA STAR Level 1 Certified (trust-and-security page)
- id: fedramp-moderate
  conforms: true
  evidence: FedRAMP Moderate Authorization; listed on FedRAMP Marketplace
- id: hipaa
  conforms: true
  evidence: HIPAA/HITECH compliance published (trust-and-security page)
- id: gdpr
  conforms: true
  evidence: GDPR compliance published; DPA available
- id: ccpa
  conforms: true
  evidence: CCPA compliance published (trust-and-security page)
- id: oauth2
  conforms: false
  evidence: no public OpenAPI/OAuth surface published
- id: rfc9457-problem-details
  conforms: false
  evidence: no public API surface