generated: '2026-07-17'
method: searched
source: openapi/prometeo-openapi.yml; https://prometeoapi.com/en; security/prometeo-trust-center.yml
standards:
  - id: apikey-auth
    conforms: true
    evidence: OpenAPI securitySchemes ApiKeyAuth (apiKey in header X-API-Key)
  - id: oauth2
    conforms: false
    evidence: No oauth2 security scheme; per-account API key + per-user banking session key
  - id: oidc
    conforms: false
  - id: open-banking
    conforms: true
    evidence: Session-based bank login (with MFA), account/movement access and account-to-account payment initiation across 7,500+ LatAm connections
  - id: pix
    conforms: true
    evidence: Brazil account validation over PIX (docs coverage page)
  - id: spei
    conforms: true
    evidence: Mexico account validation over SPEI (docs coverage page)
  - id: rtp-fednow
    conforms: true
    evidence: US account validation over RTP and FedNow (docs coverage page)
  - id: webhooks
    conforms: true
    evidence: Borderless + Payments webhook notifications with verify_token and events[] envelope
  - id: rfc9457-problem-details
    conforms: false
    evidence: Errors use a simple {status, message} JSON envelope, not application/problem+json
  - id: pci-dss
    conforms: true
    evidence: PCI DSS asserted for money-movement (Payment / Cross-Border) surfaces (marketing/partner pages)
  - id: soc2
    conforms: true
    evidence: SOC 2 asserted on prometeoapi.com
  - id: iso-27001
    conforms: true
    evidence: ISO 27001 asserted on prometeoapi.com
  - id: gdpr
    conforms: true
    evidence: GDPR asserted on prometeoapi.com
  - id: nacha-preferred-partner
    conforms: true
    evidence: Listed as a Nacha Preferred Partner (US ACH ecosystem)
notes: >-
  Compliance certifications are asserted on Prometeo marketing/partner pages and
  captured here + in security/prometeo-trust-center.yml; they should be
  reconciled against a formal security whitepaper / trust portal on a later pass.