generated: '2026-07-21'
method: searched
source: https://standardmetrics.io/security/
description: >-
  Standards and compliance posture for Standard Metrics, derived from the OpenAPI and
  the published security page. Standard Metrics is SOC 2 Type II and GDPR compliant;
  its API uses OAuth2 client-credentials over TLS 1.3.
standards:
- id: oauth2-client-credentials
  conforms: true
  evidence: Token endpoint /o/token/ exchanges client_id/client_secret for a Bearer token (grant_type=client_credentials).
- id: oidc
  conforms: false
  evidence: No OpenID Connect discovery document is published.
- id: rfc9457-problem-details
  conforms: false
  evidence: Errors are plain HTTP status codes, not application/problem+json.
- id: soc2-type-ii
  conforms: true
  evidence: Security page states SOC 2 Type II compliance, independently assessed by third-party firms.
- id: gdpr
  conforms: true
  evidence: Security page states GDPR compliance.
- id: tls1.3
  conforms: true
  evidence: All hosts negotiate TLSv1.3 (domain-security probe).
compliance_program:
  certifications: [SOC 2 Type II, GDPR]
  url: https://standardmetrics.io/security/