generated: '2026-08-13'
method: derived
source: openapi/*.yml, https://docs.talon.one/docs/dev/get-started/errors, https://trust.talon.one
provider: Talon.One
providerId: talon-one
description: Cross-cutting standards and compliance assertions, each with the evidence it rests on.
standards:
- id: openapi
  conforms: true
  evidence: Five OpenAPI documents published at https://docs.talon.one/oas/ — integration.yaml, management.yaml,
    third-party.yaml, shopify-integration.yaml and outbound-notifications.yaml. Four are OpenAPI 3.1.0;
    the Shopify one is 3.0.0 and the Third-party one 3.0.1.
- id: openapi-webhooks
  conforms: true
  evidence: outbound-notifications.yaml uses the OpenAPI 3.1 webhooks{} object to describe 24 outbound
    notification payloads.
- id: asyncapi
  conforms: false
  evidence: No AsyncAPI document is published; the event surface is described as OpenAPI 3.1 webhooks
    instead.
- id: json-schema
  conforms: true
  evidence: OpenAPI 3.1 schemas are JSON Schema 2020-12 dialect by definition of the 3.1 specification.
- id: oauth2
  conforms: false
  evidence: No oauth2 securityScheme appears in any published spec; all APIs authenticate with an API
    key in the Authorization header (Integration ApiKey-v1, Management ManagementKey-v1) or a session
    bearer token.
- id: oidc
  conforms: false
  evidence: No openIdConnect securityScheme and no /.well-known/openid-configuration on any host (all
    probed 404).
- id: rfc9457
  conforms: false
  evidence: Errors are returned as application/json with a {message, errors[]} envelope, not application/problem+json.
    See errors/talon-one-problem-types.yml.
- id: json:api
  conforms: partial
  evidence: The published error reference says the error format "is the same as that described by JSON
    API", and error entries do carry title/details/source.pointer, but the success documents are not JSON:API
    resource objects.
- id: idempotency
  conforms: true
  evidence: Integration API write endpoints accept an Idempotency-Key header; responses are stored for
    24 hours and the key is recorded in the access logs. See conventions/talon-one-conventions.yml.
- id: pagination
  conforms: true
  evidence: Offset pagination with pageSize/skip/sort plus a withTotalResultSize switch and dedicated
    no_total endpoint variants for large collections.
- id: rate-limit-headers
  conforms: false
  evidence: No X-RateLimit-*, RateLimit-* or Retry-After header is declared in any published spec, although
    429 is a declared response on 34 operations.
- id: rfc8594-sunset
  conforms: false
  evidence: 'No Sunset or Deprecation header is declared; deprecation is expressed only with OpenAPI deprecated:
    true.'
- id: mcp
  conforms: true
  evidence: Official read-only MCP server per deployment at <deployment>/v1/mcp/entrypoint, documented
    at https://docs.talon.one/docs/dev/mcp, with five provider-published Agent Skills.
- id: a2a
  conforms: false
  evidence: No agent card at /.well-known/agent-card.json or /.well-known/agent.json on any of the four
    hosts probed (all 404).
- id: llmstxt
  conforms: true
  evidence: https://docs.talon.one/llms.txt returns 200 text/plain, 67 KB, and links the five OpenAPI
    specs and seven SDK repositories.
- id: securitytxt
  conforms: false
  evidence: /.well-known/security.txt returns 404 on www.talon.one, talon.one, docs.talon.one and integration.talon.one.
compliance:
- id: iso-27001
  conforms: true
  evidence: ISO 27001 badge on www.talon.one linking to the certificate PDF at 9425930.fs1.hubspotusercontent-na1.net/hubfs/9425930/Other/ISO
    certification Talon.One.pdf (HTTP 200).
- id: soc2
  conforms: true
  evidence: 'SOC 2 badge on www.talon.one and repeated in site copy: "compliant with SOC 2, ISO, and GDPR".'
- id: gdpr
  conforms: true
  evidence: GDPR badge on www.talon.one; the Integration API ships a deleteCustomerData operation for
    erasure requests.
- id: trust-center
  conforms: true
  evidence: Vanta-hosted trust center at https://trust.talon.one (HTTP 200).
- id: pci-dss
  conforms: false
  evidence: No PCI DSS claim found on the marketing site or in the docs; Talon.One does not process card
    payments.
notes: Every entry above is backed by a document or probe performed on 2026-08-13; absence entries record
  what was probed, not an assumption.