Play · Security teams
Audit evidence for your AI agents
Evidence isa query overthe record.
Because every agent decision carries the policy that made it, the evidence for a control is a query over the record. The compliance pack runs the queries, maps them to the controls, and signs the result.
30 minutes. No commitment.
SOC 2 Type II attested · ISO/IEC 27001:2022 certified · HIPAA with a BAA · aligned to the EU AI Act and NIST AI RMF
Who
A security lead six weeks from a SOC 2 Type II renewal, at a company that put four agents into production since the last audit period.
What happened
The auditor's request list has a new section: AI systems, with access controls, logging, and data handling for each one.
What's at stake
Weeks of screenshots and spreadsheet reconstruction, controls that cannot be evidenced because nothing recorded the decisions, and a finding that follows the company into the next period.
- 01Enforce
Turn on the policies the controls expect.
The SOC 2 compliance profile checks that the policy categories it requires (audit, safety, kill switch, operations) are in place before an agent runs; it does not turn them on for you. Add PII detection with redaction, data egress limits, scope, and human approval where an action is consequential. From that point every decision is written to a durable, exportable record with the policy version that made it. Retention is set per data class, up to seven years, with legal hold.
compliance profile: SOC 2 checks audit, safety, kill switch, operations · PII redaction · policy-linked record · retention to 7 years with legal hold
govern · policies
- 02Prove
One click. One signed ZIP.
The compliance pack is a signed evidence ZIP for the period: the policy inventory, a per-control mapping with gaps shown as gaps, the governance event log, proof of PII redaction, and an Ed25519-signed attestation the auditor can verify. The pack maps per control to the OWASP LLM Top 10, NIST AI RMF, ISO/IEC 42001, the EU AI Act, HIPAA, GDPR and SOX. For a SOC 2 audit, the policy inventory and the governance event log are the evidence the AI section asks for.
signed evidence ZIP · per-control mapping · Ed25519 attestation · OWASP, NIST AI RMF, ISO 42001, EU AI Act, HIPAA, GDPR, SOX
insights · compliance pack
- 03Prove
The vendor question answers itself.
The auditor will also ask about Waxell. Waxell is SOC 2 Type II attested and ISO/IEC 27001:2022 certified, supports HIPAA with a Business Associate Agreement, and is aligned to the EU AI Act and NIST AI RMF. The Type II report is available under NDA from the Trust Center and continuous control monitoring visible there. The subprocessor question has a published list, and the retention question has a per-data-class answer.
SOC 2 Type II attested · ISO/IEC 27001:2022 certified · Trust Center
waxell · trust center- SOC 2 Type IIAttested
- ISO/IEC 27001:2022Certified
- HIPAABAA available
- EU AI ActAligned
- NIST AI RMFAligned
- crm.lookup · result held 2 emailssupport-agent · run 7f21 · PII detection · redaction logged for the packredact
- quickbooks.post · journal 4471 · $10,200finance-close · run 8a90 · human approval · controller m.diaz approvedhold
- s3.put · customers.csv · external bucketexport-agent · run 9c04 · data egress · outside allowed destinationsblock
- export · controls mapped · 2 gaps showncompliance pack · 2026 Q3 · Ed25519 signed · retention 7yallow
Illustrative entries in the shape the product writes them.
Products in this play
A policy inventory, a per-control mapping with gaps shown as gaps, the governance event log for the period, proof of PII redaction, and an Ed25519-signed attestation, as one ZIP.
Run this play this week.
Free for your first agents and devices, live in about thirty seconds. Or walk through it with someone who has run it before.
30 minutes. No commitment.
SOC 2 Type II attested · ISO/IEC 27001:2022 certified · HIPAA with a BAA · aligned to the EU AI Act and NIST AI RMF