What certification covers
- Correct use of TLS and server-only API keys; no secrets in clients.
- Verified webhook implementation (HMAC, clock skew, raw body handling).
- Idempotent contact update submissions where applicable.
- Data handling: scope of data you request and user-visible consent copy.
- Connect UI attribution: the Anemone logo and name plus links to the Anemone Terms of Service and Privacy Policy, shown wherever users connect or disconnect (built into the packaged widget; see required attribution for custom UIs).
- Test environment validation against a staging tenant.
Until your app is certified, the API may return pending_user_review or rejected for high-impact flows, depending on policy, instead of processed_globally.