generated: '2026-07-24'
method: searched
source:
  - openapi/vim-data-source-openapi-original.json
  - https://getvim.com/technology-security/
standards:
  - id: oauth2
    conforms: true
    evidence: OpenAPI declares an oauth2 client-credentials token flow (POST /oauth/token) issuing bearer JWTs.
  - id: oidc
    conforms: true
    evidence: auth.getvim.com publishes an OpenID Connect discovery document (Auth0 tenant) backing the REST API.
  - id: rfc9457-problem-details
    conforms: false
    evidence: Errors use a custom { code, reason } envelope, not application/problem+json.
  - id: fhir-r4
    conforms: false
    evidence: Proprietary insight/gap model; no FHIR resources or CapabilityStatement published.
  - id: hipaa
    conforms: true
    evidence: getvim.com/technology-security names HIPAA compliance.
  - id: soc2-type-ii
    conforms: true
    evidence: getvim.com/technology-security names SOC 2 Type II.
  - id: hitrust-csf
    conforms: true
    evidence: getvim.com/technology-security names HITRUST CSF certification.
compliance_program:
  published: true
  certifications: [HITRUST CSF, SOC 2 Type II, HIPAA]
  document_portal: https://compliance-self-service.getvim.com
  page: https://getvim.com/technology-security/