SOC 2 & AI Compliance

Overview

SOC 2 (System and Organization Controls 2) is a compliance framework developed by the American Institute of Certified Public Accountants (AICPA) that evaluates an organization's information systems against five Trust Services Criteria: security, availability, processing integrity, confidentiality, and privacy. SOC 2 is principles-based: organizations define their own controls, and an independent auditor assesses their design and operating effectiveness.

For AI and machine learning organizations, a SOC 2 report has become a de facto requirement for enterprise sales. Customers in financial services, healthcare, technology, and other regulated industries increasingly ask for SOC 2 Type II reports before approving vendors who will handle their data. A Type II report covers an observation period, commonly six to twelve months, and shows that controls operated effectively throughout that period as well as that they exist.

AI systems introduce unique considerations for SOC 2 audits. Training data pipelines, model versioning, inference endpoints, and automated decision-making systems all fall within the scope of SOC 2 assessments. Auditors evaluate how organizations protect training data confidentiality, ensure processing integrity of model outputs, maintain system availability for production AI services, and safeguard the privacy of individuals whose data appears in training datasets. Organizations that cannot demonstrate effective controls across these areas risk audit findings that delay enterprise deals.

AI-Specific Requirements

The Security category, assessed through the Common Criteria, forms the foundation of every SOC 2 engagement and is the only mandatory category. For AI systems, security controls must address access management for training data and model artifacts, change management for model deployments, risk assessment procedures for AI-specific threats, and monitoring of AI system components. Organizations must implement logical access controls that restrict who can view, modify, or delete training datasets and model weights.

Processing Integrity is particularly relevant for AI systems because it requires that system processing is complete, valid, accurate, timely, and authorized. For machine learning pipelines, this means demonstrating that training data transformations produce correct results, that model inference outputs are consistent and reliable, and that data pipeline failures are detected and resolved. Organizations must maintain evidence that their AI processing produces outputs that meet defined quality thresholds and that anomalies trigger appropriate alerts and remediation workflows.

Confidentiality and Privacy criteria require organizations to protect sensitive information throughout its lifecycle. For AI teams, this encompasses training data containing customer information, proprietary model weights, evaluation datasets, and inference logs that may contain sensitive inputs. Controls must address data classification, encryption at rest and in transit, secure disposal of data no longer needed, and restrictions on data sharing with third parties. The Privacy criterion adds requirements around notice, choice, consent, collection limitation, and data quality that align closely with GDPR and CCPA obligations.

How Ertas Helps

Your SOC 2 scope covers the systems that process your customers' data, plus the vendors those systems depend on. A self-hosted model keeps Ertas out of the production data path. Export the trained model as GGUF or safetensors and run it on infrastructure already covered by your controls, and prompts and outputs never reach Ertas, with no runtime dependency on us. You own the model, and its version stays fixed until you retrain, so it behaves like any other versioned artifact in your change management.

Training is the part that touches Ertas. Ertas Studio trains on Ertas's cloud GPUs, so the training dataset is uploaded to Ertas and stored so runs can be repeated, and you can delete it when you are done. Assess Studio as a vendor in your risk assessment, and keep confidential customer data out of training sets unless that assessment allows it. If you want Ertas to run the model, the adaptive model endpoint and enterprise builds can run it in your own cloud or on-premise, inside the environment your controls already cover.

The controls your auditor tests stay yours: logical access, logging and monitoring, encryption, change approval and availability for the systems where the model runs, plus the audit engagement itself.

Compliance Checklist