generated: '2026-08-02'
method: derived
source: openapi/taalas-inference-api-openapi.yml, openapi/taalas-inference-v1-api-openapi.yml, live probes of api.taalas.com
note: >-
  Derived from the two published OpenAPI documents plus live probes on 2026-08-02. Taalas publishes
  no compliance or certification program, so no Compliance pointer is emitted.
standards:
- id: openapi-3.1
  conforms: true
  evidence: Both published documents declare openapi 3.1.0 and parse cleanly.
- id: json-schema-2020-12
  conforms: true
  evidence: OpenAPI 3.1 schema objects use JSON Schema 2020-12 keywords (anyOf, $ref, prefix-free
    type null unions) throughout components.schemas.
- id: openai-chat-completions-compat
  conforms: true
  evidence: >-
    /v1/chat/completions and /v1/completions mirror the OpenAI request contract
    (model/messages/temperature/top_p/n/stream/stop/max_tokens/max_completion_tokens/
    presence_penalty/frequency_penalty/logit_bias/user/tools/tool_choice/logprobs/top_logprobs/
    stream_options) with additionalProperties true. Response shape is not declared in the spec, so
    compatibility of the response envelope is not machine-verifiable from the contract.
- id: http-bearer-auth-rfc6750
  conforms: partial
  evidence: >-
    Probed: Authorization Bearer is the credential the server recognises (it returns
    "Unauthorized: Invalid API Key" only for that header). However no WWW-Authenticate challenge is
    returned on 401, and no securityScheme is declared in either OpenAPI document.
- id: oauth2
  conforms: false
  evidence: No oauth2 securityScheme in either spec; no /.well-known/oauth-authorization-server or
    /.well-known/oauth-protected-resource is served.
- id: oidc
  conforms: false
  evidence: No /.well-known/openid-configuration served on taalas.com or api.taalas.com.
- id: rfc9457-problem-details
  conforms: false
  evidence: >-
    Errors use the FastAPI {"detail": ...} envelope with application/json, not
    application/problem+json.
- id: rfc9116-security-txt
  conforms: false
  evidence: /.well-known/security.txt returns 404 on taalas.com and is not served on
    api.taalas.com.
- id: rfc8594-sunset-header
  conforms: false
  evidence: No deprecation or sunset policy published; no Sunset/Deprecation headers observed.
- id: rfc9309-robots-txt
  conforms: true
  evidence: https://taalas.com/robots.txt returns 200 and declares two sitemaps.
- id: sitemaps-0.9
  conforms: true
  evidence: https://taalas.com/sitemap.xml is a valid sitemapindex naming three child sitemaps.
- id: hsts-rfc6797
  conforms: partial
  evidence: >-
    api.taalas.com returns strict-transport-security max-age=63072000; includeSubDomains; preload.
    taalas.com returns HSTS with max-age 31536000. Recorded in
    security/taalas-domain-security.yml.
- id: dnssec
  conforms: false
  evidence: security/taalas-domain-security.yml — dnssec false for taalas.com.
- id: caa
  conforms: false
  evidence: security/taalas-domain-security.yml — no CAA records for taalas.com.
- id: dmarc
  conforms: partial
  evidence: DMARC record present for taalas.com with policy p=none (monitor only).
- id: llms-txt
  conforms: false
  evidence: /llms.txt returns 404 on taalas.com, api.taalas.com and chatjimmy.ai.
- id: a2a-agent-card
  conforms: false
  evidence: >-
    /.well-known/agent-card.json and /.well-known/agent.json return 404 on taalas.com and
    chatjimmy.ai. api.taalas.com answers 401 for every unmatched path (blanket auth middleware), so
    a card cannot be confirmed there and none is asserted.
- id: mcp
  conforms: false
  evidence: >-
    No hosted MCP server found. /mcp, /v1/mcp and /sse on api.taalas.com return the same blanket
    401 as an entirely nonexistent path, so they are not evidence of an MCP surface; mcp.taalas.com
    does not resolve.
compliance_program:
  published: false
  certifications: []
  trust_center: null
  note: >-
    No trust center, SOC 2 / ISO 27001 / PCI / HIPAA / FedRAMP claim, or compliance page was found
    on taalas.com. probe-security-programs.py returned vdp=none trust=none on 2026-08-02.