generated: '2026-08-13'
method: searched
source: >-
  https://swetrix.com/security, https://swetrix.com/dpa,
  https://swetrix.com/data-policy, https://swetrix.com/docs/api/stats-v2,
  https://swetrix.com/docs/statistics-api, security/swetrix-domain-security.yml,
  well-known/swetrix-well-known.yml, openapi/*.yml
standards:
  - id: oauth2
    conforms: false
    evidence: >-
      No oauth2 securityScheme in any spec and no OAuth documentation. The API is
      API-key only (X-Api-Key). Google Search Console OAuth tokens are consumed
      by Swetrix as a client, not exposed to API consumers.
  - id: oidc
    conforms: false
    evidence: /.well-known/openid-configuration returned 404 on every host (2026-08-13).
  - id: rfc9457-problem-details
    conforms: false
    evidence: >-
      Errors use the NestJS envelope {statusCode, message, error} with
      application/json — not application/problem+json. See
      errors/swetrix-problem-types.yml.
  - id: rfc9116-security-txt
    conforms: false
    evidence: >-
      /.well-known/security.txt returned 404 on api.swetrix.com and swetrix.com.
      A security contact is published, but only on the human page
      https://swetrix.com/security (security@swetrix.com).
  - id: rfc8594-sunset-header
    conforms: false
    evidence: No deprecation or sunset policy published; no Sunset/Deprecation header documented.
  - id: json-api
    conforms: false
    evidence: >-
      Custom envelope. v2 uses {data, meta}, which resembles but does not
      implement JSON:API (no `type`/`id` resource objects, no `links`, no
      `included`).
  - id: pagination
    conforms: true
    evidence: >-
      Statistics API v2 documents offset pagination — `limit` (default 30) and
      `offset`, with `meta.total` and `sort=field:direction`
      (https://swetrix.com/docs/api/stats-v2). v1 has none.
  - id: idempotency
    conforms: true
    evidence: >-
      POST /log/revenue accepts a caller-supplied stable `transactionId`;
      re-sending the same value updates the existing transaction instead of
      creating a duplicate, and the docs prescribe it explicitly for retried
      platform webhooks. See conventions/swetrix-conventions.yml.
  - id: gdpr
    conforms: true
    evidence: >-
      Published compliance programme: a Data Processing Agreement
      (https://swetrix.com/dpa), a Data Policy (https://swetrix.com/data-policy),
      a named subprocessor list (Hetzner, Sentry, Paddle) and EU-only data
      residency (Germany, Hetzner Online GmbH). Tracking is cookieless with
      no persistent identifiers; unique visitors are counted via
      hash(daily-rotating salt + website_id + ip + user_agent) with the raw
      inputs discarded and never written to disk.
  - id: soc2
    conforms: false
    evidence: >-
      No SOC 2 report or audit claim anywhere on swetrix.com; the security page
      names no third-party certification.
  - id: iso27001
    conforms: false
    evidence: No ISO 27001 claim published.
  - id: pci-dss
    conforms: false
    evidence: >-
      Not applicable as a claim — Swetrix states that payments are handled by
      Paddle and that it does not process or store card details.
  - id: hipaa
    conforms: false
    evidence: No HIPAA claim; not a healthcare provider.
  - id: hsts
    conforms: true
    evidence: >-
      Probed 2026-08-13 — HSTS max-age 31536000 on both swetrix.com and
      api.swetrix.com, TLS 1.3 on both. See security/swetrix-domain-security.yml.
  - id: dnssec
    conforms: false
    evidence: No DNSSEC on swetrix.com (probed 2026-08-13).
  - id: caa
    conforms: false
    evidence: No CAA records on swetrix.com (probed 2026-08-13).
  - id: dmarc
    conforms: true
    evidence: DMARC present with policy `quarantine` (probed 2026-08-13).
  - id: openapi
    conforms: false
    evidence: >-
      Swetrix publishes no OpenAPI document. The NestJS backend builds a Swagger
      document but only when `isDevelopment` is true
      (backend/apps/cloud/src/main.ts), so it is never served in production —
      /api, /api-json, /openapi.json, /swagger.json, /docs and /redoc all return
      the 404 envelope on api.swetrix.com. The specs in openapi/ are API
      Evangelist artifacts written from the published reference, not provider
      documents.
  - id: graphql
    conforms: false
    evidence: POST https://api.swetrix.com/graphql returned 404 (2026-08-13).
  - id: mcp
    conforms: false
    evidence: >-
      No MCP server. tools/list POSTs to api.swetrix.com/mcp and swetrix.com/mcp
      returned 404; mcp.swetrix.com does not resolve.
  - id: a2a
    conforms: false
    evidence: >-
      /.well-known/agent-card.json and /.well-known/agent.json returned 404 on
      every Swetrix host.
  - id: asyncapi
    conforms: false
    evidence: >-
      No AsyncAPI document. An event surface DOES exist (outbound alert webhooks
      with an HMAC-SHA256 signature) and is captured in
      asyncapi/swetrix-alerts-webhooks.yml, but Swetrix publishes no
      machine-readable event contract for it.
  - id: open-source
    conforms: true
    evidence: >-
      Platform, tracking scripts and dashboards are published under AGPL-3.0 at
      https://github.com/Swetrix/swetrix, and the security page offers full
      code-base auditability as a security control.
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com