AI Model Registry
| Model | Provider | Version | Risk Tier | Approval | Data Sovereignty | Status | |
|---|---|---|---|---|---|---|---|
| GPT-4o | Azure OpenAI | 2025-05 | Tier 2 | Approved | US-only | Active | |
| Claude 3.5 Sonnet | Anthropic | 20241022 | Tier 2 | Approved | US-only | Active | |
| text-embedding-3-large | Azure OpenAI | 1.0 | Tier 1 | Approved | US-only | Active | |
| Llama 3.1 70B | Self-hosted (K8s) | 3.1 | Tier 1 | Under Review | On-prem | Pending |
Subprocessor Data Routing
| Route | Condition | Subprocessor | Data Classification | Consent Required | Status |
|---|---|---|---|---|---|
| PII-Scrub + Inference | request contains PHI/PII | Azure OpenAI (US East) | Confidential | Yes — DPA signed | Active |
| Embedding Only | request type = embed | Azure OpenAI (US East) | Internal | No (non-identifying) | Active |
| EU Customer Data | user.region = EU | Azure OpenAI (EU West) | Restricted | Yes — GDPR basis | Active |
| Training Data | data.type = training | Self-hosted vLLM | Internal | No (on-prem) | Active |
Consent Mapping Status
DPAs Signed
4/4
SCCs in Place
2/2
GDPR Bases Documented
100%
PII Filter Gateway — Live Detection Log
Redaction ActivePII Detections (Today)
1,840
Redaction Rate
100%
False Positive Rate
0.3%
Zero PII Leaks
0
Since deployment
[09:14:22] Request ID tr-8421 — SSN detected → REDACTED (***-**-4821)
[09:14:18] Request ID tr-8420 — Email detected → REDACTED (j***@acme.com)
[09:14:15] Request ID tr-8419 — No PII found. Passed.
[09:14:10] Request ID tr-8418 — Phone detected → REDACTED (+1-800-***-2841)
[09:14:08] Request ID tr-8417 — No PII found. Passed.
[09:14:01] Request ID tr-8416 — Credit card detected → REDACTED (****-****-****-2841)
[09:13:58] Request ID tr-8415 — No PII found. Passed.
Inference Trace — Hash-Linked Log
| Request ID | Model | Tokens | Latency | PII Scrubbed | SHA-256 Hash | Status |
|---|---|---|---|---|---|---|
| tr-8421 | GPT-4o | 480/220 | 412ms | 1 field | a8f3...c2d1 | OK |
| tr-8420 | GPT-4o | 320/180 | 380ms | 1 field | b4e1...f8a2 | OK |
| tr-8419 | Claude 3.5 | 640/420 | 440ms | None | c7f2...d1b4 | OK |
| tr-8418 | GPT-4o | 240/120 | 290ms | 1 field | e2a8...4c1f | OK |
Embedding Drift Monitor
Semantic Drift (30d)
0.04
Alert threshold: 0.15
Distribution Shift
Stable
Alerts Fired
0
Last 90 days
Drift Score Over Time
Week 1Week 2Week 3Week 4Week 5Week 6
SOC 2 + AI Control Dashboard
Overall Readiness
96%
Standard Controls (CC1-9)
9/9
AI-Specific Controls
7/7
Evidence Items
248
| Control | Category | Evidence | Readiness | Status |
|---|---|---|---|---|
| CC1.1 — Control Environment | Standard | 18 items | Ready | |
| CC6 — Logical Access | Standard | 24 items | Ready | |
| AI-1 — Model Approval | AI-specific | 12 items | Ready | |
| AI-3 — PII Filtering | AI-specific | 8 items | Ready | |
| AI-5 — Drift Monitoring | AI-specific | 6 items | In Review |
Evidence Vault
Total Items
248
S3 Write-Once
248
WORM compliant
Auditor Access
Enabled
Last Upload
2h ago
| Evidence ID | Control | Type | Collected | S3 Link | |
|---|---|---|---|---|---|
| EVD-1042 | AI-3 PII Filtering | System Log | Today 08:00 | s3://vault/ai-3/2026-06-22… | |
| EVD-1041 | CC6 Logical Access | Access Review | Jun 21 | s3://vault/cc6/2026-06-21… | |
| EVD-1040 | AI-5 Drift Monitor | Drift Report | Jun 20 | s3://vault/ai-5/2026-06-20… |
Gap Analysis — 7 Critical Findings → 0
Initial Findings
7 critical
Current Open
0
All resolved
Avg Closure Time
18 days
| Finding | Control | Severity | Remediation | Closed | Status |
|---|---|---|---|---|---|
| No PII scrubbing before LLM calls | AI-3 | Critical | Deployed Azure AI Content Safety | Week 3 | Closed |
| AI model changes not reviewed | AI-1 | Critical | Formal model review + approval gate | Week 4 | Closed |
| No inference audit log | AI-4 | Critical | Hash-linked trace log implemented | Week 5 | Closed |
| Subprocessor DPAs missing | CC2 | High | All DPAs executed and filed | Week 6 | Closed |
Audit Timeline — BrightLine Advisors
Week 1-2 — Complete
Readiness assessment. 7 critical gaps identified and remediation plan created.
Week 3-6 — Complete
Remediation: PII filter, model review board, inference logging, DPAs signed.
Week 7-9 — Complete
Evidence collection for all 248 items. Auditor access provisioned.
Week 10-11 — Complete
External audit fieldwork. All inquiries addressed. 0 unresolved findings.
Week 11 — Complete
SOC 2 Type II report issued. Zero exceptions noted for AI-specific controls.
Evidence Submission Tracker
| Request | Due | Submitted | Status |
|---|---|---|---|
| User access list — production systems | Week 7 | Week 7 | Done |
| Penetration test report | Week 8 | Week 8 | Done |
| AI model approval records | Week 9 | Week 9 | Done |
AI Security Review — Process Improvement
Review Time (Before)
11 weeks
Review Time (Now)
3 weeks
73% faster
AI-Assisted Controls
7 new
Manual Effort Saved
840h
| Process | Before | After | Tool | Savings |
|---|---|---|---|---|
| PII audit log collection | Manual (3 weeks) | Automated (real-time) | Azure AI Content Safety | 160h |
| Model risk assessment | Ad-hoc (2 weeks) | Structured 3-day review | Risk scoring matrix | 120h |
| Evidence packaging | Manual (2 weeks) | Automated S3 WORM upload | Lambda + S3 Object Lock | 280h |
| Gap analysis | Spreadsheet (2 weeks) | Automated scan (1 day) | Custom compliance scanner | 180h |
| Auditor Q&A | 4 weeks back-and-forth | 1 week (structured portal) | Evidence vault + auditor UI | 100h |