Why AI Use Matters Under SOC 2
AI tools are a new path for sensitive data to leave the organization. Auditors ask how that path is restricted and monitored, and "we have a policy" is not evidence that a control operated.
Controls ProctoredAI Evidences
| Control | Evidence in the Monthly Report |
|---|---|
| CC6.7 Restrict transmission of data | Sensitive transmissions to AI services blocked or redacted. |
| CC7.2 Monitor system components | Endpoints reporting with enforcement active. |
| CC6.1 Logical access / data classification | Sensitive data at rest discovered and classified on endpoints. |
Each client's report lists these controls with a status. Evidenced means the mechanism produced records in the period; Active means it is enforced with nothing to record; Not configured means the feature is off for that client.
Policy Packs Applied
Selecting SOC 2 for a client applies these packs in one step:
- Credentials & Secrets. Block API keys, private keys, passwords and connection strings everywhere.
- Visibility Baseline. Log every sensitive-data finding, even when nothing is blocked.
- Endpoint DLP. Secrets never leave on USB or the clipboard; everything sensitive on removable media, the clipboard and at rest is logged.
The Setup Checklist
Some steps live outside the policy rules. The console hands the provider this list:
- Generate a monthly stored report for change-tracking evidence
- Review the audit log verification under Admin
What the Auditor Receives
- A monthly AI Governance Report for the client, stored with a SHA-256 digest so the copy an auditor holds can be matched to the console.
- An evidence bundle with every non-usage event in the period, the client's audit-log entries and the head hash of the audit chain.
- The AI Use Policy generated from the client's real configuration, with each employee's acknowledgment and version.
AI Apps to Decide On First
- Claude CodeMedium
- CodexMedium
- ChatGPTMedium
- ClaudeMedium
- Google GeminiMedium
- Microsoft CopilotLow
- GitHub CopilotMedium
- CursorMedium
- Windsurf / CodeiumMedium
- Meta AIMedium
- Hugging Face (Chat & Spaces)Medium
- LMArenaHigh
Questions
Which SOC 2 criteria does AI governance support?
Restricting data transmission (CC6.7), monitoring system components (CC7.2) and logical access with data classification (CC6.1), each with the evidence described on this page.
How does an auditor verify the evidence?
Each stored monthly report is frozen with a SHA-256 digest, and the evidence bundle adds a digest of the events and the head hash of the audit-log chain. The auditor can recompute the digests themselves.
Does this cover developers using AI coding tools?
Yes. The agent recognizes coding assistants and command-line tools such as Claude Code and Codex by their client signatures, and the Credentials and Secrets pack blocks keys and connection strings everywhere.
ProctoredAI supports a client's compliance program; it does not by itself make a client compliant, and it is not legal advice. All frameworks · The MSP AI governance guide