SOC 2

SOC 2是由美国注册会计师协会（AICPA）制定的服务型企业安全审计标准，评估安全性、可用性、处理完整性、保密性和隐私性五个维度

金融、医疗、政府等受监管行业通常需要遵循SOC 2、HIPAA、PCI DSS等安全合规框架

该API的审计能力旨在帮助企业满足SOC 2、GDPR、HIPAA等合规框架的要求

企业用户使用API中转站时应评估其是否具备SOC 2、ISO 27001等安全合规认证

ChatGPT Enterprise已通过SOC 2等企业安全认证

The Secure by Default principle has since been widely adopted by mainstream security frameworks such as OWASP and NIST.

The SOC 2 compliance standard lists audit trails as a key control item under two trust service criteria: security and processing integrity.

For regulated industries such as finance, healthcare, and defense, sending code to third-party AI services may violate data residency requirements under compliance frameworks such as SOC 2, HIPAA, and GDPR.

SOC 2 and ISO 27001 auditors will focus on whether access permissions follow the principle of least privilege, whether accounts of departed employees are promptly reclaimed, whether privileged accounts have additional controls, and whether identity changes have traceable logs.

SOC 2 / ISO 27001 audit fees themselves can be on the order of tens of thousands to hundreds of thousands of dollars, and increase as customer scale and compliance requirements escalate.

Audit logs are used to record operation history and are commonly used for security review, troubleshooting, and compliance certifications such as SOC 2 and ISO 27001.

Setting defaults to the most conservative and leaving convenience features for users to actively enable can satisfy compliance audit requirements (such as SOC 2 and ISO 27001 requirements for change management and asset inventories).

Leaver流程是身份治理中的关键控制点：员工离职后，其在各下游系统中的账号必须及时停用或回收，否则会形成孤儿账号，成为合规审计（如SOX、ISO 27001、SOC 2）中的高风险项。

Compliance frameworks such as SOC 2 and ISO 27001 require the principle of least privilege and traceable access controls, and shared keys cannot pass such audits.

When evaluating AI vendors, attention should be paid to their SOC 2 compliance status, vulnerability response SLAs, and whether they have regular third-party security audit mechanisms.

Compliance frameworks (such as SOC 2, PCI DSS, and ISO 27001) typically have explicit requirements for integrity and non-repudiation of audit logs.

Compliance frameworks such as SOC 2 and ISO 27001 explicitly require that plaintext credentials must not appear in logs.

Compliance frameworks such as SOC 2 and GDPR typically explicitly require that production data must not be used for development or testing purposes.

When uploading operational data to a third-party AI platform, one should confirm whether the data is used for model training, the method of storage encryption, deletion rights, and compliance certifications such as SOC 2.

Embedding an escalation matrix into a Skill allows approval trigger conditions and final decisions to be automatically recorded, helping to meet compliance requirements such as SOC 2 and ISO 27001.