generated: '2026-08-05'
method: searched
source: https://savanainc.com/company/
note: >-
  Savana publishes a named certification and compliance posture in prose on its
  company page and privacy policy, but publishes no machine-readable API contract,
  so every API-level standard below is recorded as unverifiable rather than false —
  there is no OpenAPI, AsyncAPI, GraphQL SDL or MCP manifest to derive conformance
  from. The compliance entries are the company's own published claims, captured
  verbatim; API Evangelist has not audited them.
compliance_program:
  published: true
  url: https://savanainc.com/company/
  statement: >-
    "Savana meets the highest security and compliance standards, maintaining SOC 1
    Type II, SOC 2 Type II, PCI, HIPAA, and FFIEC certifications."
  secondary_source: https://savanainc.com/privacy-policy/
  certifications:
  - SOC 1 Type II
  - SOC 2 Type II
  - PCI DSS
  - HIPAA
  - FFIEC
standards:
- id: soc2-type-ii
  conforms: true
  evidence: company page states SOC 2 Type II certification (provider claim, unaudited)
- id: soc1-type-ii
  conforms: true
  evidence: company page states SOC 1 Type II certification (provider claim, unaudited)
- id: pci-dss
  conforms: true
  evidence: company page and privacy policy both cite PCI DSS (provider claim, unaudited)
- id: hipaa
  conforms: true
  evidence: company page and privacy policy cite HIPAA where applicable (provider claim, unaudited)
- id: ffiec
  conforms: true
  evidence: company page and privacy policy cite FFIEC (provider claim, unaudited)
- id: iso-27001
  conforms: false
  evidence: not claimed anywhere on the public site
- id: fedramp
  conforms: false
  evidence: not claimed anywhere on the public site
- id: oauth2
  conforms: unverifiable
  evidence: no public OpenAPI or auth documentation to inspect
- id: oidc
  conforms: unverifiable
  evidence: /.well-known/openid-configuration returned 404 on savanainc.com
- id: rfc9457-problem-details
  conforms: unverifiable
  evidence: no public specification or error reference
- id: rfc9116-security-txt
  conforms: false
  evidence: /.well-known/security.txt returned 404
- id: fdx
  conforms: unverifiable
  evidence: no public specification; Savana is a servicing layer above the core, FDX not claimed