Skip to main content
Auditors are starting to ask how your team controls AI coding tools. The Compliance page lists each AI control with its status and SOC 2 Trust Services Criteria (TSC) mapping, shows the population behind it, and exports evidence your reviewers can verify.
These controls help you collect evidence for your own audits. ReclaimLLM’s own SOC 2 Type II is targeted for Q4 2026; it is not yet certified.

​
Prepare audit evidence

1

Check control health

The Control health tab lists each RC-AI control with pass, fail, or n/a status, TSC mapping, and population and exception counts. Failed controls, like an overdue quarterly access review, are flagged.
2

View a control's population

Click View population to see the evidence entries behind a control. Entries contain no session content.
3

Log risk exceptions

Accept a known risk with Request exception in the Risk exceptions register.
4

Generate an evidence pack

In Evidence & exports, pick a period and click Generate CSV pack. Packs include a SHA-256 manifest so reviewers can verify nothing changed.
5

Run access reviews

Use Create campaign in Access reviews to review gateway keys, members, and API keys.
Compliance Control health table with RC-AI controls, pass fail and n/a status, TSC mapping and a failed quarterly access review callout

​
Example: RC-AI-02 population

RC-AI-02 checks that sensitive reads are redacted before transmission. Opening View population shows a linked session, b9b69a10-a7bc-46a4-8309-d9b99f31a381, with status new and flagged AD-004: The DLP gap means one sensitive read happened that no policy covered. One click opens the session itself.
RC-AI-02 View population panel with session b9b69a10 flagged AD-004, read access, matched .env pattern and a DLP gap of 1 uncovered sensitive read
Evidence and exports tab with a period picker and Generate CSV pack button

​
FAQ

Not yet. ReclaimLLM’s SOC 2 Type II is targeted for Q4 2026. The Compliance page helps you gather evidence about your own AI coding controls.
CSV files for the period you pick, with a SHA-256 manifest so reviewers can confirm the files haven’t changed.
It counts sensitive reads that were not covered by a policy versus those that were. In the RC-AI-02 example, one .env read was uncovered.