SOC 2
Run your SOC 2 program where the rest of your controls already live.
The Trust Services Criteria, mapped to a starter control set you adopt, own, test, and evidence. Controls land in your library with owners and schedules, evidence is tracked for freshness, and your auditor gets a read-only link instead of a folder.
Built by Anapto, which runs its own SOC 2 program on ClarityGRC.
AI in scope, not an afterthought.
Most SOC 2 tools were built before AI was in the system. Here the AI governance program and the SOC 2 program share one control library, so the AI systems your auditor now asks about are inventoried, risk-tiered, and evidenced alongside everything else, with no separate scramble.
Adopt
The criteria, as controls you can actually run.
Adopt the starter control set and the Trust Services Criteria land in your control library as real controls, each with an owner to assign and a test schedule. The Security common criteria are required; Availability, Confidentiality, Processing Integrity, and Privacy are there when you commit to them.
- A starter control set mapped to every common criterion, tailored by an advisor
- Controls live in the same library as the rest of your program, not a side system
- A readiness view shows exactly which criteria are met, in progress, or a gap
Operate
Tested on a cadence, evidenced as you go.
Each control gets re-checked on its schedule, and the evidence is collected as the work happens and tracked for freshness. Stale evidence surfaces itself before the audit, not during it.
- Scheduled control tests with effectiveness recorded against each one
- Evidence register with collection and expiry dates, so nothing goes stale unseen
- Findings tracked to closure, the way an auditor expects a remediation list to work
Prove
Hand the auditor a link, not a folder.
When the auditor asks, the answer is a scoped, read-only share link to a live view, plus evidence requests they can track to done and an append-only audit trail behind all of it.
- Read-only examiner and auditor links, scoped and revocable
- Evidence requests (PBC lists) your auditor can track to done
- Append-only audit trail, legal hold, and per-company isolation
How it works
From criteria to a clean audit.
- 1
Adopt the starter set
The Trust Services Criteria become controls in your library, each ready for an owner and a schedule.
- 2
Run the cadence
Controls are tested on schedule and evidence is collected as work happens, tracked for freshness.
- 3
Show your readiness
The SOC 2 view shows where you stand, and a read-only link gives the auditor a live look.
Stop running SOC 2 out of a spreadsheet.
Bring your current control list or your last audit to the demo, and we will show it running in the platform.
Self-serve signup with published pricing is coming. Early access runs through demos.