SOC 2

What it requires

SOC 2 evaluates an organisation's information systems relevant to security, availability, processing integrity, confidentiality, and privacy. For AI systems, SOC 2 audits increasingly examine model governance, data handling, and the integrity of AI-driven processing as part of the trust services criteria.

Trust services criteria for AI

• Security (CC): Protection of AI systems and data against unauthorised access, including model endpoints and training data
• Availability (A): AI system uptime, failover, and incident recovery commitments
• Processing integrity (PI): AI outputs are complete, valid, accurate, timely, and authorised. Model drift and degradation monitoring
• Confidentiality (C): Protection of confidential information processed by AI systems, including training data and model weights
• Privacy (P): Personal information collected, used, retained, disclosed, and disposed of in conformity with commitments

How Vigilens automates it

Vigilens maps SOC 2 trust services criteria to controls evidenced from your AI system's pipeline. The focus is on criteria where AI systems introduce novel risks: processing integrity for model outputs, security for model endpoints, and privacy for training data.

• Security controls evidenced from CI/CD pipeline (branch protection, secrets management, access logs)
• Processing integrity controls linked to model monitoring, drift detection, and accuracy metrics
• Availability controls mapped to deployment infrastructure and SLA evidence
• Confidentiality controls for model weights, training data, and proprietary algorithms
• Cross-mapped to ISO 27001 Annex A controls for organisations pursuing both certifications

SOC 2 and other frameworks

Many enterprise AI vendors need SOC 2 Type II reports alongside EU AI Act compliance and ISO certifications. Vigilens de-duplicates evidence collection across frameworks: an access control evidence artifact collected once can satisfy SOC 2 CC6.1, ISO 27001 A.8.3, and EU AI Act Article 15 simultaneously.