generated: '2026-07-20'
method: searched
source: https://www.originhq.com/legal/service-terms
standards:
- id: soc2-type-ii
  conforms: true
  evidence: >-
    Service Terms state "Copies of Origin's then-current SOC 2 Type II report are available on
    reasonable written request, subject to confidentiality."
  access: on-request
- id: oauth2
  conforms: true
  evidence: Hosted MCP server secured with OAuth 2.1; live oauth-authorization-server metadata present.
- id: oidc
  conforms: true
  evidence: Authorization server publishes /.well-known/openid-configuration with userinfo + RS256 id_token.
- id: rfc8414-oauth-as-metadata
  conforms: true
  evidence: /.well-known/oauth-authorization-server returns 200 at the auth host.
- id: rfc9728-protected-resource-metadata
  conforms: true
  evidence: MCP server exposes /.well-known/oauth-protected-resource (200).
- id: gdpr
  conforms: true
  evidence: Data Processing Agreement (/legal/dpa) and subprocessor list (/legal/sub-processor-list) published.
- id: iso-27001
  conforms: false
- id: pci-dss
  conforms: false
- id: hipaa
  conforms: false
- id: fedramp
  conforms: false