generated: '2026-08-26'
method: searched
source: https://www.payem.co/legal/security-and-compliance + openapi/payem-ai-discovery-openapi.json
conformance:
- id: openapi-3.1
  conforms: true
  evidence: >-
    openapi/payem-ai-discovery-openapi.json declares "openapi": "3.1.0" and parses, with
    10 documented operations, unique operationIds and a components.schemas entry.
- id: schema-org
  conforms: true
  evidence: >-
    Every 200 response is schema.org JSON-LD - Organization on /business, OfferCatalog
    with itemListElement on /products, FAQPage on /faq, Dataset on knowledge.json - served
    as application/ld+json with an @context of https://schema.org.
- id: json-ld
  conforms: true
  evidence: 'Content-Type: application/ld+json on /business; @context/@graph document structure.'
- id: rfc9457
  conforms: false
  evidence: >-
    Errors are a bespoke {error, requested_endpoint, available_endpoints} JSON object.
    No application/problem+json anywhere.
- id: oauth2
  conforms: false
  evidence: No oauth2 securityScheme in the spec; /.well-known/oauth-authorization-server 404 on payem.co.
- id: oidc
  conforms: false
  evidence: >-
    /.well-known/openid-configuration returns 404 on payem.co. PayEm does support SAML SSO
    into the application via an external IdP (Google, Okta) per its security page, but that
    is SAML, not OIDC, and it is an application login rather than an API surface.
- id: idempotency
  conforms: na
  evidence: Read-only contract, no write operations. See conventions/payem-conventions.yml.
- id: pagination
  conforms: false
  evidence: skills.json declares pagination false; no cursor or offset parameters exist.
- id: rfc8594
  conforms: false
  evidence: No Deprecation or Sunset headers observed or documented.
- id: rfc9116
  conforms: false
  evidence: /.well-known/security.txt returns 404 on www.payem.co and 403 on app.payemcard.com.
- id: cors
  conforms: true
  evidence: 'access-control-allow-origin: * with an explicit allow-headers/allow-methods set on every response.'
- id: hsts
  conforms: true
  evidence: 'strict-transport-security: max-age=63072000 on www.payem.co (see security/payem-domain-security.yml).'
domain_standard:
  market: spend management / accounts payable / procurement
  candidates_probed:
  - standard: ISO 20022
    conforms: false
    evidence: >-
      No pain.001/camt message type, no ISO 20022 identifier and no payment-initiation
      surface appears in the contract or in any public PayEm document. PayEm makes
      cross-border payments through partners rather than publishing a payments contract.
  - standard: ANSI X12 / EDIFACT (810 invoice, 850 purchase order)
    conforms: false
    evidence: >-
      PayEm markets purchase orders and invoice processing, but exposes them only through
      native ERP connectors (NetSuite, QuickBooks Online, Priority ERP, Xero). No EDI
      transaction set, no envelope and no message schema is published.
  - standard: Open Peppol / UBL
    conforms: false
    evidence: No Peppol participant identifier or UBL invoice schema is published.
  - standard: PSD2 / Open Banking
    conforms: false
    evidence: >-
      Not applicable - PayEm is a US/Israel spend-management platform issuing cards
      through partners, not a regulated account-servicing payment service provider, and it
      publishes no account-information or payment-initiation API.
  conforms: false
  note: >-
    Reward-only dimension. PayEm's market does have candidate standards (ISO 20022 for
    payment messages, X12 810/850 for invoices and purchase orders, Peppol/UBL for
    e-invoicing) and PayEm conforms to none of them in any published contract. This is
    recorded as an honest negative, not a penalty - PayEm publishes no product contract at
    all, so there is nothing in which a domain standard could have been declared.
compliance:
  certifications:
  - SOC 1 Type II
  - SOC 2 Type II
  regimes:
  - GDPR
  - CCPA
  auditor: EY
  audit_cadence: annual
  source: https://www.payem.co/legal/security-and-compliance
  detail_pages:
  - https://www.payem.co/legal/soc-2
  - https://www.payem.co/legal/soc-1-type-ii-compliant
  trust_center: https://security.payem.co/
  security_controls_published:
  - multi-factor authentication (required)
  - SAML SSO via external IdP
  - encryption in transit (HTTPS) and at rest (AES-256 or higher)
  - in-field encryption for sensitive data
  - least-privilege access with audit logging
  - continuous automated penetration testing
  - WAF and rate limiting against brute force