SOC 2, for an AI product.

The essay

SOC 2, for an AI product.

SOC 2 for an AI product is a different audit than SOC 2 for a SaaS product. The auditor's questions are the same on the surface (access control, change management, monitoring) but the answers are different because the AI product has new failure modes (model drift, prompt injection, hallucinated outputs) that the SOC 2 framework did not anticipate.

The VZU posture is: the runtime is the compliance boundary. Access control is enforced at the agent level, not the user level. Change management is enforced on prompts, models, and tool definitions, with every change versioned and auditable. Monitoring is enforced on every tool call, every model call, every agent decision, with the full conversation history retained for the auditor.

The auditor's questions, and the VZU answers: who can call which model? (RBAC at the agent level, with the answer in the audit trail.) Who can change a prompt? (Versioned, with the answer in the audit trail.) Who can see the inference log? (The operator, with the answer in the data residency configuration.) What happens when a model returns a 500? (Caught, logged, retried with backoff, with the answer in the operational audit trail.)

SOC 2 Type II is the certification, not the posture. The posture is what the operator does every day, regardless of whether the auditor is in the building. The certification is the auditor's confirmation that the posture is real. VZU is in active pursuit of SOC 2 Type II, with the audit window opening in Q3 2026.

For operators evaluating VZU against a competitor on SOC 2: ask the competitor the same questions. If the answer is "we have SOC 2", ask which type (Type I is a point-in-time attestation, Type II is a period-of-time attestation). Ask for the most recent report. Ask what was in scope. Ask what was out of scope. The answers will be revealing.