generated: '2026-07-21'
method: derived
source: >-
  https://docs.tecton.ai/docs/security + authentication/tecton-authentication.yml +
  conventions/tecton-conventions.yml
standards:
  - id: rest-json
    conforms: true
    evidence: FeatureService HTTP API is a JSON-over-HTTPS request/response API under /api/v1/
  - id: api-key-auth
    conforms: true
    evidence: HTTP API authenticated via Authorization Tecton-key header bound to Service Accounts
  - id: oauth2
    conforms: false
    evidence: no OAuth2 authorization/token flows documented for the API (interactive SDK login is SSO)
  - id: rfc9457-problem-details
    conforms: false
    evidence: errors surface as HTTP status codes with a JSON body; application/problem+json not documented
  - id: soc2
    conforms: true
    evidence: SOC 2 stated on https://docs.tecton.ai/docs/security
  - id: iso-27001
    conforms: true
    evidence: ISO 27001 stated on https://docs.tecton.ai/docs/security
  - id: gdpr
    conforms: true
    evidence: GDPR stated on https://docs.tecton.ai/docs/security
compliance:
  published: true
  certifications: [SOC 2, ISO 27001, GDPR]
  source: https://docs.tecton.ai/docs/security