generated: '2026-08-09'
method: derived
source: >-
  openapi/planomy-tax-data-openapi.yml, live response headers (2026-08-09), and
  https://planomy.net/data/
description: >-
  Which cross-cutting standards this API actually conforms to. Every `conforms: true` below is backed
  by an observed header or an observed response shape; every `conforms: false` is a real absence, not
  an unchecked box. Planomy publishes no compliance or certification programme, so no Compliance
  pointer is claimed for this provider.
standards:
  - id: http-conditional-requests
    name: HTTP conditional requests (RFC 9110 §13)
    conforms: true
    evidence: >-
      Strong ETag emitted on both endpoints; If-None-Match returned 304 on 2026-08-09.
  - id: http-caching
    name: HTTP caching (RFC 9111)
    conforms: true
    evidence: 'Cache-Control: public, max-age=0, must-revalidate on both endpoints.'
  - id: hsts
    name: HTTP Strict Transport Security (RFC 6797)
    conforms: true
    evidence: 'strict-transport-security: max-age=63072000; includeSubDomains; preload'
  - id: tls13
    name: TLS 1.3
    conforms: true
    evidence: Negotiated TLSv1.3 (security/planomy-tax-data-domain-security.yml).
  - id: csp
    name: Content Security Policy Level 3
    conforms: true
    evidence: >-
      A restrictive CSP is sent on every response, including the JSON — default-src 'self', object-src
      'none', frame-ancestors 'none', base-uri 'self'.
  - id: cors
    name: Fetch/CORS
    conforms: partial
    evidence: >-
      access-control-allow-origin: * is sent on both endpoints, so simple cross-origin GETs work. But
      OPTIONS returns 405, so preflighted requests fail, and the documentation states the opposite of
      the deployed behaviour. Deployed and stated policy disagree.
  - id: json
    name: JSON (RFC 8259)
    conforms: true
    evidence: Both endpoints return well-formed application/json; parsed successfully 2026-08-09.
  - id: iso8601-dates
    name: ISO 8601 / RFC 3339 dates
    conforms: true
    evidence: publishedAt is a date-time, lastUpdated and sources.*.retrieved are dates.
  - id: llms-txt
    name: llms.txt
    conforms: true
    evidence: >-
      https://planomy.net/llms.txt returns 200 text/plain and follows the format — H1, blockquote
      summary, then sectioned link lists. Also publishes /llms-full.txt.
  - id: robots-txt
    name: robots.txt
    conforms: true
    evidence: >-
      Present and deliberately permissive; explicitly allows OAI-SearchBot, ChatGPT-User,
      PerplexityBot, Perplexity-User, Claude-SearchBot, Claude-User, Googlebot, Bingbot and Applebot.
  - id: sitemaps-xml
    name: sitemaps.org XML
    conforms: true
    evidence: https://planomy.net/sitemap.xml returns 200.
  - id: openapi
    name: OpenAPI
    conforms: false
    evidence: >-
      Planomy publishes no OpenAPI. Probed /openapi.json, /openapi.yaml, /swagger.json, /api-docs,
      /redoc and /apis.json on the API host — all 404. The spec in openapi/ is API Evangelist-authored
      from observed responses.
  - id: json-schema
    name: JSON Schema
    conforms: false
    evidence: >-
      The schema is documented in prose at https://planomy.net/data/#schema only; /data/schema.json and
      /tax-data/schema.json both 404. The `schema` field inside each dataset points at the prose anchor,
      not a machine-readable document.
  - id: rfc9457-problem-details
    name: RFC 9457 Problem Details
    conforms: false
    evidence: Errors return the site HTML 404 page, not application/problem+json.
  - id: rfc9116-security-txt
    name: security.txt (RFC 9116)
    conforms: false
    evidence: /.well-known/security.txt returns 404.
  - id: rfc9727-api-catalog
    name: api-catalog (RFC 9727)
    conforms: false
    evidence: /.well-known/api-catalog returns 404. /tax-data/index.json is the de facto catalogue.
  - id: rfc8594-sunset
    name: Sunset header (RFC 8594)
    conforms: false
    evidence: No Sunset or Deprecation headers; no deprecation policy published.
  - id: oauth2
    name: OAuth 2.0
    conforms: false
    evidence: No authentication of any kind — the API is keyless by design.
  - id: oidc
    name: OpenID Connect
    conforms: false
    evidence: /.well-known/openid-configuration returns 404.
  - id: a2a
    name: A2A Agent Card
    conforms: false
    evidence: >-
      Both /.well-known/agent-card.json and the legacy /.well-known/agent.json return 404 on
      planomy.net.
  - id: asyncapi
    name: AsyncAPI
    conforms: false
    not_applicable: true
    evidence: >-
      There is no event surface to describe. The API is two static files; there are no webhooks,
      streams or queues. /feed.xml is an RSS feed of editorial guides, not an API event channel.
  - id: pagination
    name: Pagination convention
    conforms: false
    not_applicable: true
    evidence: Single-document responses; nothing to page.
  - id: idempotency-keys
    name: Idempotency keys
    conforms: false
    not_applicable: true
    evidence: >-
      Read-only surface. Every operation is a GET and is idempotent by HTTP semantics, so no
      idempotency-key protocol exists or is needed.
compliance_program:
  published: false
  certifications: []
  evidence: >-
    No trust centre, no SOC 2 / ISO 27001 / PCI / HIPAA / FedRAMP claim. probe-security-programs.py
    returned vdp=none trust=none on 2026-08-09; /security, /trust and /compliance all 404. Consistent
    with a free public-domain dataset published by a small independent product.