CSOAI
Initializing...
Free forever · No credit card
CSOAI
Initializing...
SOC 2 Type II readiness kit — £999 one-time + £199/mo monitoring (optional)
Enterprise buyers demand SOC 2 Type II. We map every trust services criterion to the realities of generative AI — prompt injection, model supply chain, inference monitoring, and data residency — so your audit passes the first time.
AI-specific controls auditors now ask for
SOC 2 Quick Start
£9one-time
30-question readiness assessment and a one-page gap summary.
Get £9 Quick StartSOC 2 Type II Kit
£999one-time
Pre-mapped controls, policies, evidence templates, and one signed readiness attestation.
Buy — £999Audit-Prep Bundle
£4,950one-time
Kit + 2-day engagement + mock auditor review + 90-day support.
Buy Audit-Prep — £4,950Enterprise
£1,499/month
Continuous control monitoring, quarterly evidence refresh, and unlimited attestations.
Talk sales — £1,499/moCC6.1 + CC6.6 access & change control
Identity governance, least-privilege role matrix, and immutable change logs for model deployments, prompt templates, and infrastructure.
CC7.2 anomaly detection for AI
Monitoring rules tuned to generative AI risks: prompt injection spikes, data exfiltration patterns, model drift, and unauthorised API keys.
CC8.1 change management
Versioned model releases, rollback playbooks, signed attestation per deployment, and automated evidence collection for the audit window.
Privacy & confidentiality mapping
Data classification, retention schedules, encryption at rest and in transit, and sub-processor governance aligned to SOC 2 privacy criteria.
Yes. SOC 2 applies to any organisation that stores, processes, or transmits customer data. For AI companies, the audit scope must include model hosting, prompt logging, inference APIs, training data handling, and third-party model providers.
Type I can be achieved in 4-8 weeks. Type II requires an observation period of at least 3 months (often 6-12 months). The kit compresses readiness by providing pre-mapped controls, policies, and evidence templates.
The kit covers Security (common criteria), Availability, Confidentiality, and Privacy. Processing Integrity is available as an add-on for systems that perform automated transactions or calculations.
Yes. We export evidence to Vanta, Drata, Sprinto, AuditBoard, and ServiceNow GRC formats. The HMAC-signed attestation can also be referenced directly in your trust centre.
Policy documents, access reviews, change tickets, monitoring screenshots, penetration-test results, encryption certificates, sub-processor agreements, and signed control attestations. The kit organises these by TSC and audit period.
Need an information-security baseline first?
See the ISO 27001 kit →MEOK AI Labs · CSOAI LTD · UK Companies House 16939677