Does a SOC 2 report cover a vendor's AI?

Usually not. SOC 2 tests the Trust Services Criteria — security, availability, confidentiality, processing integrity, privacy. It has no criteria for model training on customer data, LLM sub-processors, prompt injection defenses, output integrity, or rollback. A clean SOC 2 Type II tells you the vendor's infrastructure controls operated; it says nothing about how their AI behaves.

What is an AI vendor attestation gap check?

It is a review of the evidence a vendor gave you — a SOC 2, ISO 27001, ISO 42001 or pentest report — against what you actually need to know before buying an AI product. It extracts scope, exclusions, exceptions, sub-processors and AI mentions from the document, then lists the gaps as questions to send the vendor and the controls the report assumes you perform.

What documents can I upload?

SOC 2 Type I or Type II, SOC 1, ISO 27001 or ISO 42001 certificates and statements of applicability, and third-party penetration test reports, as PDF. Uploads go to private storage and are used only to produce your analysis.

Which frameworks are the gaps mapped to?

Findings are tested against the obligations for your industry — OCC and interagency third-party risk guidance and NYDFS 500 for financial services, HIPAA and the HHS AI guidance for healthcare, plus EU AI Act Article 50 transparency and ISO 42001 where AI is core to the product. Where a grounded library exists we cite the clause; otherwise the gap is stated at the obligation level.

Is this a compliance opinion about the vendor?

No. The output assesses the adequacy of the evidence, not the vendor's actual security posture. Every gap is phrased as a question to put to the vendor so your procurement or security team can close it directly.

How long does it take and what does it cost?

About 90 seconds after upload, and it is free. You get an on-screen report, a permanent shareable link and a PDF. Teams evaluating many AI vendors can ask about the consultant-led AI Vendor Portfolio Review.

Free · AI Vendor Attestation Gap Check

Their SOC 2 is clean. It still tells you nothing about their AI.

AI controls fall outside the SOC 2 Trust Services Criteria. Upload the attestation your vendor sent you and we'll show you exactly what it does not evidence — model training on your data, LLM sub-processors, output integrity, rollback criteria — plus the scope exclusions, exceptions and obligations that land on your team.

~90 secondsQuestions you can send your vendorMapped to your industry's frameworks

Vendor name *

Product or service you're buying

Attestation type *

How is AI involved? *

Your industry *

Your company

Your name

Work email *

Attestation document (PDF) *Choose the SOC 2 / ISO report your vendor sent you

Uploaded to private storage and never made public — only you and our team can access it. We read it to produce your analysis and retain it with your report; email us and we'll delete it. Most attestations are shared under NDA, so confirm you're permitted to upload it.

This analysis assesses the adequacy of the evidence provided, not the vendor's security. It is not a compliance opinion, audit, or legal advice.

SECVANTAGES