generated: '2026-08-02'
method: searched
source: https://www.salsify.com/security-and-reliability, https://developers.salsify.com/docs/oauth2,
  openapi/*.json
standards:
- id: openapi-3.1
  conforms: true
  evidence: All three published definitions declare openapi 3.1.0 (harvested to openapi/).
- id: oauth2
  conforms: true
  evidence: >-
    Authorization Code grant documented at https://developers.salsify.com/docs/oauth2 and
    confirmed live by RFC 8414 metadata at /.well-known/oauth-authorization-server.
- id: rfc8414-authorization-server-metadata
  conforms: true
  evidence: well-known/salsify-oauth-authorization-server.json (HTTP 200, application/json).
- id: rfc9728-protected-resource-metadata
  conforms: true
  evidence: >-
    https://app.salsify.com/.well-known/oauth-protected-resource/mcp returns the MCP
    resource metadata naming https://app.salsify.com as the authorization server.
- id: rfc7636-pkce
  conforms: true
  evidence: code_challenge_methods_supported includes S256 in the authorization-server metadata.
- id: oidc
  conforms: false
  evidence: >-
    No /.well-known/openid-configuration is served (app.salsify.com returns an HTML
    catch-all). Salsify is an OAuth 2.0 provider, not an OIDC provider.
- id: saml-2.0
  conforms: true
  evidence: >-
    SSO documented for AD FS 2.0, OneLogin, PingIdentity, Google Apps, Entra ID, Okta and
    generic SAML 2.0 IdPs (https://developers.salsify.com/docs/sso-overview).
- id: mcp
  conforms: true
  evidence: >-
    First-party remote MCP server at https://app.salsify.com/mcp responding to JSON-RPC with
    an OAuth 2.1 bearer challenge.
- id: graphql
  conforms: true
  evidence: >-
    Public GraphQL endpoint at https://api.salsify.com/graphql with a published schema
    reference; introspection is auth-gated.
- id: rfc9457-problem-details
  conforms: false
  evidence: >-
    No application/problem+json responses in any published spec; error bodies are plain JSON
    (and text/plain on several operations).
- id: rfc8594-sunset-header
  conforms: false
  evidence: No Sunset/Deprecation header contract or deprecation policy is published.
- id: rfc9116-security-txt
  conforms: false
  evidence: >-
    /.well-known/security.txt is absent on every Salsify host, although a responsible
    disclosure policy and vdp@salsify.com contact are published on the marketing site.
- id: a2a
  conforms: false
  evidence: >-
    No A2A Agent Card at /.well-known/agent-card.json or /.well-known/agent.json on any host
    (app.salsify.com answers 200 with an HTML cookie-consent page for every unknown
    well-known path; developers.salsify.com and www.salsify.com return 404).
- id: asyncapi
  conforms: false
  evidence: >-
    Salsify has a real webhook event surface but publishes no AsyncAPI document; the webhook
    catalog is captured in asyncapi/salsify-webhooks.yml.
- id: json-api
  conforms: false
  evidence: 'Custom JSON envelope with a salsify: namespace, not JSON:API.'
- id: gs1-gdsn
  conforms: true
  evidence: >-
    Salsify operates a GS1-certified GDSN data pool (https://www.salsify.com/pxm/gdsn),
    validates synchronized logistical data against market, industry and retailer-specific
    GDSN requirements, and publishes GDSN maintenance-release updates (attribute
    add/delete/change and validation-rule changes) in its quarterly product notes. GTIN
    normalization is open-sourced as the salsify-gtin gem.
  note: >-
    GDSN synchronization is a platform capability, not part of the public REST/GraphQL
    contract harvested into openapi/.
- id: soc2-type2
  conforms: true
  evidence: >-
    SOC 2 Type II for ProductXM and SupplierXM, audited annually
    (https://www.salsify.com/security-and-reliability).
- id: iso-27001
  conforms: true
  evidence: ISO 27001:2013 certification, certificate downloadable from the security page.
- id: gdpr
  conforms: true
  evidence: GDPR compliance with a Data Processing Agreement and a Data Subject Access Request portal.
- id: ccpa
  conforms: true
  evidence: Privacy policy updated 2020-01-01 for CCPA.
- id: nist-800
  conforms: true
  evidence: Security framework stated to be based on NIST 800 recommendations.
- id: pci-dss
  conforms: false
  evidence: Not claimed; Salsify is not a payments provider.
- id: hipaa
  conforms: false
  evidence: Not claimed.
- id: fedramp
  conforms: false
  evidence: Not claimed.