generated: '2026-08-29'
method: searched
source: openapi/stax-api-openapi.json + https://docs.staxpayments.com/reference/tls-security-standards + https://staxpayments.com/blog/what-is-pci-compliance-how-stax-protect-your-payments/
standards:
- id: openapi-3.1
  conforms: true
  evidence: 'openapi/stax-api-openapi.json declares openapi: 3.1.0 with 101 paths and 133 operations, each with a unique operationId.'
- id: oauth2
  conforms: false
  evidence: No oauth2 securityScheme anywhere in the contract; authentication is a bearer API key (http/bearer). scopes/ is
    intentionally not emitted.
- id: oidc
  conforms: false
  evidence: No openIdConnect scheme; /.well-known/openid-configuration 404s on both hosts.
- id: rfc9457
  conforms: false
  evidence: No application/problem+json media type in the contract; errors are a field-keyed validation object or a bare string
    array. See errors/stax-problem-types.yml.
- id: rfc8594
  conforms: false
  evidence: 'No Deprecation or Sunset headers documented; no operation carries deprecated: true.'
- id: rfc9116
  conforms: true
  evidence: https://staxpayments.com/.well-known/security.txt returns 200 with Contact, Expires, Encryption, Preferred-Languages,
    Canonical and Hiring fields. Saved verbatim to well-known/stax-security.txt.
- id: idempotency
  conforms: true
  partial: true
  evidence: idempotency_id request parameter on POST /charge and POST /invoice/{id}/pay returns the original transaction on
    replay (https://docs.staxpayments.com/docs/idempotency). NOT the IETF Idempotency-Key header draft, and not declared in
    the contract.
- id: pagination
  conforms: true
  evidence: Laravel paginator envelope (total, per_page, current_page, last_page, next_page_url, prev_page_url, from, to,
    data) in the published list-operation examples.
- id: tls-1.2-minimum
  conforms: true
  evidence: https://docs.staxpayments.com/reference/tls-security-standards — TLS 1.2/1.3 only; SSLv2, SSLv3, TLS 1.0 and TLS
    1.1 blocked at the network level, with the accepted cipher suites enumerated. Applies to webhook receivers as well as
    API clients.
- id: json:api
  conforms: false
  evidence: No JSON:API media type or document structure.
- id: odata
  conforms: false
  evidence: No $metadata endpoint or OData query syntax.
- id: scim
  conforms: false
  evidence: No SCIM schema URNs; user management is a bespoke /team/user surface.
- id: fapi
  conforms: false
  evidence: No FAPI profile, no mTLS, no OAuth.
- id: psd2
  conforms: false
  evidence: US/Canada acquiring; no PSD2/Open Banking surface.
domain_standards:
- id: pci-dss
  conforms: true
  role: Level 1 Service Provider
  evidence: 'Stax states on its own site that it is a Level 1 PCI Service Provider — the highest level — and publishes merchant
    PCI compliance obligations (90 days to become compliant, SAQ status reporting, PCI scans) in its documentation. Sources:
    https://staxpayments.com/blog/what-is-pci-compliance-how-stax-protect-your-payments/ and https://docs.staxpayments.com/docs/pci-compliance.
    Not read from the contract — this is a published claim, not a machine-readable declaration.'
- id: nacha-ach
  conforms: true
  evidence: 'The contract''s ACH surface is governed by NACHA rules and the published error registry includes NACHA SEC (Standard
    Entry Class) code errors (code 1007 ''SEC Code Not Authorized'') and ACH Notice of Change handling. Spec location: the
    ACH reporting operations ach-rejections (GET /query/statement/v3/ach-rejects) and the error registry at https://docs.staxpayments.com/reference/ach-error-codes.
    Captured in errors/stax-ach-error-codes.yml.'
- id: card-network-refund-matching
  conforms: true
  evidence: 'Stax documents Visa/Mastercard/Discover/Amex refund-matching requirements by network, including Mastercard Trace
    ID (DE 48 subelement 63) and TLID (DE 105 subelement 002, effective 2026-06-02), and Amex Authorization on Credit. Source:
    https://docs.staxpayments.com/docs/refund-guidelines. Captured in conventions/stax-conventions.yml reversibility.'
- id: level-2-processing
  conforms: true
  evidence: 'Level 2 interchange qualification is supported through the meta.tax field on a charge, with the published rule
    that tax must be between 0.1% and 30% of the transaction total. Spec location: POST /charge request body meta object;
    docs https://docs.staxpayments.com/docs/level-2-processing-data-integration.'
- id: emv-card-present
  conforms: true
  evidence: Card-present acceptance (swipe/dip/tap, Tap to Pay on iPhone, PIN pads, IDTech readers) via the /terminal/* operations
    and the iOS/Android SDKs.
compliance_programs:
- name: PCI DSS Level 1 Service Provider
  published: true
  source: https://staxpayments.com/blog/what-is-pci-compliance-how-stax-protect-your-payments/
- name: Merchant PCI compliance program (SAQ, scans, notifications, non-compliance fee up to $79.99)
  published: true
  source: https://docs.staxpayments.com/docs/pci-compliance
- name: HIPAA-aware payment workflows (healthcare vertical)
  published: true
  source: https://staxpayments.com/pricing/
  note: Marketed as 'HIPAA-aware'; Stax does not publish a HIPAA attestation or BAA terms.
- name: Trust Center
  published: true
  url: https://trust.staxpayments.com/
  note: Live at trust.staxpayments.com but rendered entirely client-side (a Laika-hosted single-page app); no certification
    names are readable without executing JavaScript.
regulated_role: 'Stax Payments, Inc. is a registered ISO/MSP in association with Fifth Third Bank (Cincinnati, OH) and Pinnacle
  Bank, a Tennessee bank dba Synovus Bank (Columbus, GA), and a registered partner/ISO of Elavon, Inc. (Georgia, a U.S. Bancorp
  subsidiary). Stax Canada, Inc. is a registered MSP/ISO of the Canadian branch of U.S. Bank National Association and Elavon.
  Source: the footer of https://staxpayments.com/pricing/.'