generated: '2026-07-21'
method: derived
source: developer portal + live API probe + security page
standards:
  - id: oauth2
    conforms: false
    evidence: API uses HTTP Basic auth with an API token, no OAuth2 flows documented
  - id: rfc9457-problem-details
    conforms: false
    evidence: errors use a custom JSON envelope, not application/problem+json
  - id: scim2
    conforms: partial
    evidence: >-
      Staffbase publishes a SCIM 2.0 SDK (github.com/Staffbase/scim2) and supports
      SCIM-based user provisioning; not asserted from a captured spec
  - id: iso27001
    conforms: true
    evidence: ISO 27001 certified per staffbase.com/security
  - id: soc2
    conforms: true
    evidence: SOC 2 attested per staffbase.com/security
  - id: gdpr
    conforms: true
    evidence: GDPR compliance program documented
  - id: hipaa
    conforms: true
    evidence: HIPAA BAA available for healthcare customers