AI SOC 2 Compliance Vault

AI SOC 2 Compliance Vault — sign in to continue.

SimFictional data
4Demo roles
0Prod systems

Sign in

Accounts are provisioned by an administrator. No self-registration.

Invalid email or password. Try a demo account below.
Email
Password
Verifying credentials…

Prototype accounts — click to fill and sign in

Session expiring

You've been idle. For security this session ends automatically in 15s.

Sign out?

Unsaved filter selections will be cleared. You'll return to the sign-in screen.

Model Registry
AI Compliance Vault / Model Registry
SOC 2 Type II — Ready Loading
??
Switch role (demo)
AI Model Registry
ModelProviderVersionRisk TierApprovalData SovereigntyStatus
GPT-4oAzure OpenAI2025-05Tier 2ApprovedUS-onlyActive
Claude 3.5 SonnetAnthropic20241022Tier 2ApprovedUS-onlyActive
text-embedding-3-largeAzure OpenAI1.0Tier 1ApprovedUS-onlyActive
Llama 3.1 70BSelf-hosted (K8s)3.1Tier 1Under ReviewOn-premPending
Subprocessor Data Routing
RouteConditionSubprocessorData ClassificationConsent RequiredStatus
PII-Scrub + Inferencerequest contains PHI/PIIAzure OpenAI (US East)ConfidentialYes — DPA signedActive
Embedding Onlyrequest type = embedAzure OpenAI (US East)InternalNo (non-identifying)Active
EU Customer Datauser.region = EUAzure OpenAI (EU West)RestrictedYes — GDPR basisActive
Training Datadata.type = trainingSelf-hosted vLLMInternalNo (on-prem)Active
Consent Mapping Status
DPAs Signed
4/4
SCCs in Place
2/2
GDPR Bases Documented
100%
PII Filter Gateway — Live Detection Log
Redaction Active
PII Detections (Today)
1,840
Redaction Rate
100%
False Positive Rate
0.3%
Zero PII Leaks
0
Since deployment
[09:14:22] Request ID tr-8421 — SSN detected → REDACTED (***-**-4821)
[09:14:18] Request ID tr-8420 — Email detected → REDACTED (j***@acme.com)
[09:14:15] Request ID tr-8419 — No PII found. Passed.
[09:14:10] Request ID tr-8418 — Phone detected → REDACTED (+1-800-***-2841)
[09:14:08] Request ID tr-8417 — No PII found. Passed.
[09:14:01] Request ID tr-8416 — Credit card detected → REDACTED (****-****-****-2841)
[09:13:58] Request ID tr-8415 — No PII found. Passed.
Inference Trace — Hash-Linked Log
Request IDModelTokensLatencyPII ScrubbedSHA-256 HashStatus
tr-8421GPT-4o480/220412ms1 fielda8f3...c2d1OK
tr-8420GPT-4o320/180380ms1 fieldb4e1...f8a2OK
tr-8419Claude 3.5640/420440msNonec7f2...d1b4OK
tr-8418GPT-4o240/120290ms1 fielde2a8...4c1fOK
Embedding Drift Monitor
Semantic Drift (30d)
0.04
Alert threshold: 0.15
Distribution Shift
Stable
Alerts Fired
0
Last 90 days
Drift Score Over Time
Week 1Week 2Week 3Week 4Week 5Week 6
SOC 2 + AI Control Dashboard
Overall Readiness
96%
Standard Controls (CC1-9)
9/9
AI-Specific Controls
7/7
Evidence Items
248
ControlCategoryEvidenceReadinessStatus
CC1.1 — Control EnvironmentStandard18 items
Ready
CC6 — Logical AccessStandard24 items
Ready
AI-1 — Model ApprovalAI-specific12 items
Ready
AI-3 — PII FilteringAI-specific8 items
Ready
AI-5 — Drift MonitoringAI-specific6 items
In Review
Evidence Vault
Total Items
248
S3 Write-Once
248
WORM compliant
Auditor Access
Enabled
Last Upload
2h ago
Evidence IDControlTypeCollectedS3 Link
EVD-1042AI-3 PII FilteringSystem LogToday 08:00s3://vault/ai-3/2026-06-22…
EVD-1041CC6 Logical AccessAccess ReviewJun 21s3://vault/cc6/2026-06-21…
EVD-1040AI-5 Drift MonitorDrift ReportJun 20s3://vault/ai-5/2026-06-20…
Gap Analysis — 7 Critical Findings → 0
Initial Findings
7 critical
Current Open
0
All resolved
Avg Closure Time
18 days
FindingControlSeverityRemediationClosedStatus
No PII scrubbing before LLM callsAI-3CriticalDeployed Azure AI Content SafetyWeek 3Closed
AI model changes not reviewedAI-1CriticalFormal model review + approval gateWeek 4Closed
No inference audit logAI-4CriticalHash-linked trace log implementedWeek 5Closed
Subprocessor DPAs missingCC2HighAll DPAs executed and filedWeek 6Closed
Audit Timeline — BrightLine Advisors
Week 1-2 — Complete
Readiness assessment. 7 critical gaps identified and remediation plan created.
Week 3-6 — Complete
Remediation: PII filter, model review board, inference logging, DPAs signed.
Week 7-9 — Complete
Evidence collection for all 248 items. Auditor access provisioned.
Week 10-11 — Complete
External audit fieldwork. All inquiries addressed. 0 unresolved findings.
Week 11 — Complete
SOC 2 Type II report issued. Zero exceptions noted for AI-specific controls.
Evidence Submission Tracker
RequestDueSubmittedStatus
User access list — production systemsWeek 7Week 7Done
Penetration test reportWeek 8Week 8Done
AI model approval recordsWeek 9Week 9Done
AI Security Review — Process Improvement
Review Time (Before)
11 weeks
Review Time (Now)
3 weeks
73% faster
AI-Assisted Controls
7 new
Manual Effort Saved
840h
ProcessBeforeAfterToolSavings
PII audit log collectionManual (3 weeks)Automated (real-time)Azure AI Content Safety160h
Model risk assessmentAd-hoc (2 weeks)Structured 3-day reviewRisk scoring matrix120h
Evidence packagingManual (2 weeks)Automated S3 WORM uploadLambda + S3 Object Lock280h
Gap analysisSpreadsheet (2 weeks)Automated scan (1 day)Custom compliance scanner180h
Auditor Q&A4 weeks back-and-forth1 week (structured portal)Evidence vault + auditor UI100h