Docs · SOC 2
Norcaster produces the runtime evidence for the AI portion of a SOC 2 audit — the gatewayed AI traffic a readiness platform cannot see. Norcaster cannot perform or issue SOC 2 reports; only a licensed CPA firm can attest under AICPA standards. Your auditor attests; Norcaster evidences.
A Type II examination samples controls across a real observation window — runtime evidence accrues in real time and cannot be backfilled. The window you can cover starts when the gateway does.
The SOC 2 view of the obligations catalogue maps Trust Services Criteria to stored evidence. A criterion is tagged runtime-evidenced only when a stored field backs it; where the judgment is human, the tag says so — with an owner and a review date. This mapping is Norcaster's draft pending validation in live CPA fieldwork.
RBAC with discrete permissions, External Reviewer deny-list, access audit log, permission-gated exports — the access review itself is a human attestation, recorded with owner and review date.
Boundary enforcement on every gatewayed request; blocked-event records with rule, policy version, and timestamp — sensitive input stopped before the provider.
One enforcement decision per gatewayed request; adversarial-input detections stored with violation codes; eval results stored in-product.
Blocked events and fail-closed deployment-stop audit records as inputs; the incident process is attested with owner and review date.
policy_version pinned to every decision; platform audit trail for lifecycle changes; applied-proposal provenance from decision to source clause.
Provider attribution and failover events as inputs; the programs are organizational judgments recorded as attestations.
Run records with status, provider failover events, deployment stop/resume records; SLO commitments and continuity plans are attested.
A policy verdict on every gatewayed AI call; approval-gate decisions logged with actor identity and the request they apply to.
Redaction events as masked metadata (never message bodies); decision-level evidence-store retention; response caching opt-in, default off.
SOC 2 scopes an entire service organization. Norcaster is one evidence source — the AI-runtime slice — not the readiness platform. These areas never appear as criterion rows, and their absence is stated in the product and printed in every SOC 2 bundle:
A SOC 2 bundle adds a criterion-mapping section a CPA firm's workpapers can cite: for each criterion — reference, honesty tag, the bundle sections backing it, the evidence rows included in the bundle, and the attestation citation or its explicit gap. Counts state their basis on the artifact. The cover carries the CPA-boundary statement verbatim; CSV and PDF exports ship with the standalone verifier and JSON bundles embed the verification instructions — integrity confirmation requires no trust in Norcaster.
For audit firms: the attestation and the client relationship stay with the firm; Norcaster supplies the runtime evidence AI-heavy clients cannot otherwise produce. To discuss an engagement or a walkthrough: contact us.
No. A SOC 2 report can only be performed and issued by a licensed CPA firm under AICPA standards — no software platform can attest, including Norcaster. What software can do is produce the evidence the auditor samples. Norcaster produces the runtime evidence for the AI slice of a SOC 2 examination: boundary enforcement, monitoring, change management, processing integrity, and confidentiality records captured per request on gatewayed AI traffic.
Nine Trust Services Criteria groups map to the AI runtime, honesty-tagged: runtime-evidenced where a stored field backs the criterion (system boundaries CC6.6–6.7, monitoring CC7.1–7.2, change management CC8.1, processing integrity PI1, confidentiality C1), mixed where runtime records meet an attested process (incident management, availability), and requires-attestation where the judgment is organizational (the access review, risk and vendor programs). A SOC 2 audit bundle adds a criterion-mapping section a CPA firm's workpapers can cite.
No — it complements them. A readiness platform covers the organization: laptops, people, policies, org-wide controls. It cannot see inside AI runtime traffic. Norcaster evidences that slice — the requests, redactions, policy decisions, and approvals on gatewayed AI traffic. Two different evidence surfaces, one audit; HR, endpoints, physical security, BCP, and org-wide vendor management remain readiness-platform territory, and Norcaster states that boundary in the product and in every SOC 2 bundle.
Not yet, and we say so plainly: SOC 2 Type II preparation is underway, the observation window opens November 2026, and the report follows the examination, available under NDA. We deliberately skipped Type I. Meanwhile, EU-hosted and self-hosted deployment options shrink the vendor-risk surface a security review must assess.
Capabilities described as of August 2026. The criterion mapping is Norcaster's draft pending validation in live CPA fieldwork. Norcaster is not a CPA firm; this page is not an attestation, an audit deliverable, or legal advice. SOC 2 examinations and reports are performed and issued exclusively by licensed CPA firms under AICPA standards. Companion reference: EU AI Act readiness evidence.