generated: '2026-07-21'
method: searched
source: https://www.udesk.cn/product_safety_features.html + https://www.udesk.cn/doc/
description: >-
  Standards conformance asserted from Udesk's published docs and security page.
  Security/compliance certifications are published on the 隐私和数据防护
  (privacy and data protection) page; API-protocol conformance is captured
  from the developer docs (no OpenAPI is published, so protocol entries are
  doc-based rather than spec-derived).
standards:
  - id: iso-27001
    conforms: true
    evidence: "ISO 27001:2013 certification named on https://www.udesk.cn/product_safety_features.html (安全认证 section)"
  - id: csa-star
    conforms: true
    evidence: "CSA-STAR cloud-security certification named on https://www.udesk.cn/product_safety_features.html"
  - id: china-mlps-level-3
    conforms: true
    evidence: "网络安全等级保护三级 (China Multi-Level Protection Scheme Level 3) stated on https://www.udesk.cn/product_safety_features.html"
  - id: trusted-cloud-china
    conforms: true
    evidence: "可信云认证 NO.07014 (Trusted Cloud certification) shown in the site footer"
  - id: oauth2
    conforms: false
    evidence: No OAuth2 surface; all APIs use digest-signature auth (see authentication/udesk-authentication.yml)
  - id: oidc
    conforms: false
    evidence: /.well-known/openid-configuration returns 404; SSO is JWT HS256 per
      https://www.udesk.cn/doc/sercive/sso/ (SAML/OAuth/LDAP only via the separate OneInto product)
  - id: jwt
    conforms: true
    evidence: ServiceGo SSO is HS256 JWT (aud=U_SERVICE) per https://www.udesk.cn/doc/sercive/sso/
  - id: rfc9457-problem-details
    conforms: false
    evidence: Open API errors use a vendor {code, message} envelope (1000 = success), not application/problem+json
  - id: pagination
    conforms: true
    evidence: Documented page-based pagination (meta.current_page/total_pages/total_count on
      Open API v2; paging.pageNum/pageSize/total on ServiceGo/KCS)
  - id: idempotency
    conforms: false
    evidence: No idempotency-key mechanism documented anywhere in the developer docs
  - id: rfc9116-security-txt
    conforms: false
    evidence: /.well-known/security.txt returns 404 (probed 2026-07-21)
  - id: scim
    conforms: false
    evidence: No SCIM provisioning surface documented