generated: '2026-07-21'
method: searched
source: https://developer.safetyculture.com + https://safetyculture.com/security
standards:
- id: scim2
  conforms: true
  evidence: >-
    User provisioning via SCIM 2.0 with Microsoft Entra ID (Azure AD) and Okta,
    documented at developer.safetyculture.com user-provisioning guides.
- id: rfc3339-datetime
  conforms: true
  evidence: API accepts a subset of RFC 3339 Internet Date-Time Format for date/time values.
- id: rfc9116-security-txt
  conforms: true
  evidence: PGP-signed /.well-known/security.txt served on api and root hosts.
- id: soc2
  conforms: true
  evidence: SOC 2 stated on https://safetyculture.com/security.
- id: iso27001
  conforms: true
  evidence: ISO 27001 stated on https://safetyculture.com/security.
- id: oauth2
  conforms: false
  evidence: Auth is bearer API token; no OAuth 2.0 authorization flow documented.
- id: rfc9457-problem-details
  conforms: false
  evidence: No application/problem+json error format documented.
- id: fhir-r4
  conforms: false
- id: fapi
  conforms: false