generated: '2026-08-29'
method: searched
source: https://tastewise.io/trust
docs: https://tastewise.io/trust
note: >-
  Standards posture read from the provider's own trust page and API reference. Tastewise
  publishes named security certifications but the API itself conforms to very few
  cross-cutting API standards — it is a bespoke REST surface with no OpenAPI, no OAuth and
  no RFC 9457 errors.
standards:
- id: oauth2
  conforms: false
  evidence: Authentication is a static bearer API key plus an X-Customer-Id header; no OAuth 2.0 flows are documented.
- id: oidc
  conforms: false
  evidence: No OpenID Connect discovery document on any host; /.well-known/openid-configuration returns 404/403.
- id: openapi
  conforms: false
  evidence: >-
    No machine-readable OpenAPI/Swagger document is published. Probed the API host root,
    the docs host and the website for /openapi.json, /swagger.json and /api-docs — all miss.
    The reference at docs.tastewise.io is human-readable Slate HTML only.
- id: asyncapi
  conforms: false
  evidence: A webhook surface exists but no AsyncAPI document is published.
- id: rfc9457-problem-details
  conforms: false
  evidence: Errors use a vendor JSON envelope {error, message, retry_after}, not application/problem+json.
- id: rfc9116-security-txt
  conforms: false
  evidence: No /.well-known/security.txt on any Tastewise host.
- id: rfc8594-sunset-header
  conforms: false
  evidence: No deprecation or sunset policy or headers documented.
- id: rate-limit-headers
  conforms: true
  evidence: >-
    The API returns X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset and a 429
    with a retry_after field. These are the de-facto X-RateLimit-* convention, not the
    IETF draft RateLimit-* header field names.
  source: https://docs.tastewise.io/
- id: pagination
  conforms: true
  evidence: Offset/page pagination via page + page_size (results_per_page / limit on some routes).
  note: Inconsistent parameter naming across the surface.
- id: idempotency
  conforms: false
  evidence: No idempotency key or replay-safety contract documented on the write surface.
- id: iso-27001
  conforms: true
  evidence: '"Tastewise is ISO 27001:2013 and ISO 27017:2015 compliant" — https://tastewise.io/trust'
  scope: organizational security management, not an API conformance claim
- id: iso-27017
  conforms: true
  evidence: '"Tastewise is ISO 27001:2013 and ISO 27017:2015 compliant" — https://tastewise.io/trust'
  scope: cloud services security controls
- id: gdpr
  conforms: true
  evidence: >-
    "operates procedures in line with the EU General Data Protection Regulation (GDPR)";
    annual GDPR training required for all employees — https://tastewise.io/trust
- id: soc2
  conforms: false
  evidence: No SOC 2 report or Type II attestation is claimed on the trust page.
domain_standard:
  market: food and beverage consumer intelligence / foodservice menu data
  standard_declared: null
  conforms: false
  evidence: >-
    No domain standard is declared in the contract. The API's own vocabularies — cuisines,
    delivery platforms, markets, motivations, audiences, categories, life-cycle stages — are
    published as closed lists in the documentation but are proprietary Tastewise enumerations,
    not GS1, GDSN, FoodOn or any other published food-industry data standard. Restaurant and
    product identifiers are Tastewise-internal integers/SKUs with no external identifier
    scheme (no GTIN, no GLN) documented.
  note: >-
    REWARD-ONLY dimension — recorded as absent, not penalized. Foodservice/CPG menu
    intelligence has no widely-adopted machine-readable interchange standard that this
    contract could have declared.
certifications_published:
- name: ISO 27001:2013
  url: https://tastewise.io/trust
- name: ISO 27017:2015
  url: https://tastewise.io/trust
- name: GDPR
  url: https://tastewise.io/trust
x-evidence:
  fetched: '2026-08-29'
  trust_url: https://tastewise.io/trust
  trust_http_status: 200
  docs_url: https://docs.tastewise.io/
  docs_http_status: 200