generated: '2026-08-02'
method: searched
source: https://security.tensorwave.com/
spec_source: openapi/tensorwave-scalarlm-openapi.yml
standards:
- id: openapi-3.1
  conforms: true
  evidence: openapi/tensorwave-scalarlm-openapi.yml (derived from source; not provider-published)
  note: TensorWave publishes no static OpenAPI; a running ScalarLM deployment serves FastAPI's
    generated spec at /openapi.json.
- id: openai-chat-completions-api
  conforms: true
  evidence: 'The router at /v1/chat/completions, /v1/completions and /v1/models proxies vLLM and
    reuses vLLM''s OpenAI protocol types (ChatCompletionRequest, CompletionRequest). README and
    scalarlm.com/inference both document drop-in OpenAI-compatible usage.'
- id: sse-server-sent-events
  conforms: true
  evidence: text/event-stream responses on createChatCompletion, createCompletion and
    getTrainingLogs.
- id: w3c-trace-context
  conforms: true
  evidence: 'The logging middleware parses the inbound `traceparent` header and extracts the trace
    id (infra/cray_infra/api/fastapi/main.py).'
- id: opentelemetry
  conforms: true
  evidence: init_tracing(app, service_name="scalarlm-api") at application startup.
- id: prometheus-exposition
  conforms: true
  evidence: GET /v1/metrics returns Prometheus text exposition format.
- id: oauth2
  conforms: false
  evidence: No oauth2 securityScheme and no OAuth documentation.
- id: oidc
  conforms: false
- id: rfc9457-problem-details
  conforms: false
  evidence: 'No application/problem+json anywhere. Errors are FastAPI''s 422 detail envelope or an
    inline `error` string on a 200 response. See errors/tensorwave-problem-types.yml.'
- id: rfc8594-sunset-header
  conforms: false
  evidence: No Sunset or Deprecation header handling; no deprecation policy published.
- id: rfc9116-security-txt
  conforms: false
  evidence: No /.well-known/security.txt on any host. See well-known/tensorwave-well-known.yml.
- id: idempotency-key
  conforms: false
  evidence: No idempotency key header or parameter exists. See conventions/tensorwave-conventions.yml.
- id: json-api
  conforms: false
- id: odata
  conforms: false
- id: scim2
  conforms: false
- id: fhir-r4
  conforms: false
- id: fapi
  conforms: false
- id: psd2
  conforms: false
- id: asyncapi
  conforms: false
  evidence: 'No event or webhook surface. TensorWave''s alerting is Slack and email notifications
    configured in-product (docs.tensorwave.com/observability/notifications-and-alerts), not
    subscribable webhooks, so there is nothing to describe in AsyncAPI. Not a penalty case.'
- id: mcp
  conforms: false
  evidence: No hosted or packaged MCP server found for TensorWave or ScalarLM.
- id: a2a
  conforms: false
  evidence: 'No agent card at /.well-known/agent-card.json or /.well-known/agent.json on any
    host. tensorwave.com returns SPA catch-all HTML for both paths; docs.tensorwave.com and
    www.scalarlm.com return 404.'
compliance_program:
  published: true
  url: https://security.tensorwave.com/
  certifications:
  - name: SOC 2
    type: Type 2
    period: '2025'
    status: Compliant
  - name: ISO 27001
    version: v2022
    period: '2025'
    status: Compliant
  - name: HIPAA
    status: Compliant
  reports_available: request-access
  see: security/tensorwave-trust-center.yml
data_protection:
  dpa: https://tensorwave.com/dpa
  supply_chain: https://tensorwave.com/supply-chain
  privacy_policy: https://tensorwave.com/privacy
hardware_software_stack:
- id: amd-rocm
  conforms: true
  evidence: 'TensorWave runs AMD Instinct accelerators on AMD''s open ROCm stack; ROCm is the
    first topic in the documentation (docs.tensorwave.com/welcome-to-tensorwave/introduction-to-rocm).'
- id: slurm
  conforms: true
  evidence: Managed Slurm is a product; the API exposes squeue/scancel operations.
- id: kubernetes
  conforms: true
  evidence: Managed Kubernetes is a product; the org publishes a slurm-operator and an AMD GPU
    k8s device plugin.