Framework Mapping · SOC 2 Type II AI Controls

SOC 2 AI Controls

Live evidence mapping against SOC 2 Trust Services Criteria applied to AI systems. Evidence pulled directly from execution data.

Transparency note: TrustLayers does not claim SOC 2 certification. This page maps live evidence to each criterion so auditors and enterprise clients can assess control coverage themselves.
1,324
Events in evidence base
2%
Processing integrity sealed
0%
Error rate
0
Control exceptions
CC1 — Control Environment
CC1.1
COSO principle: integrity and ethics
All AI actions logged with agent_id — accountability at every execution.
✓
CC1.2
Board oversight of AI controls
Human override field records every human intervention in AI decisions.
→ 0 overrides
✓
CC1.4
Commitment to competence
10 agents under continuous governance monitoring.
→ 10 agents
✓
CC2 — Communication
CC2.1
Information to support controls
Public EEI, Replay and Report pages communicate evidence to stakeholders.
✓
CC2.2
Internal communication of objectives
Blueprint pre-runtime config communicates governance rules before execution.
✓
CC2.3
Communication with external parties
Public transparency pages expose live data to regulators and clients.
✓
CC6 — Logical Access
CC6.1
Logical access security measures
API key authentication controls which agents can log events.
✓
CC6.6
Logical access restrictions
sensitive_data flag identifies and isolates sensitive access events.
→ 4 sensitive events
✓
CC6.7
Transmission and movement of data
100% European infrastructure — France and Lithuania. Data never leaves EU.
✓
CC7 — System Operations
CC7.1
Detect and monitor for vulnerabilities
anomaly_score and risk_score fields detect behavioral anomalies per event.
→ 1324 events monitored
✓
CC7.2
Monitor AI system components
drift_detected flag monitors for behavioral deviation in real time.
→ 0 drift events
✓
CC7.3
Evaluate security events
compliance_status and error_code logged on every event for evaluation.
→ 0 violations evaluated
✓
CC7.4
Respond to security incidents
Immutable event log with error_code enables incident response and forensics.
→ 0 error events logged
✓
CC9 — Risk Mitigation
CC9.1
Risk mitigation activities
EEI score quantifies evidence gaps — enabling targeted risk mitigation.
✓
CC9.2
Business disruption risk
Async architecture — TrustLayers never blocks AI execution path.
✓
A1 — Availability
A1.1
Availability commitments and requirements
Event logging is asynchronous — zero impact on AI system availability.
✓
A1.2
Environmental protections
EU infrastructure with redundancy. No single point of failure in log chain.
✓
PI1 — Processing Integrity
PI1.1
Processing integrity policies
SHA-256 prompt_hash + output_hash seals every input/output pair.
→ 2% sealed
✓
PI1.2
System processing is complete and accurate
Immutable ledger — no record can be modified after logging.
→ 1324 immutable records
✓
PI1.4
Outputs are complete and accurate
output_hash cryptographically proves output integrity per event.
✓