Skip to main content
Compliance in ReclaimLLM is an evidence report for AI coding controls — not a SOC 2 attestation or certification. It turns coverage, anomalies, gateway usage, offboarding, and alert delivery into daily control statuses that auditors can rely on without seeing prompts, code, or secrets.
ReclaimLLM does not certify your organization. Snapshots and exports are designed for auditor reliance; your assessor still owns the attestation opinion.

​
What you get

​
Guardrails

  1. Content-free evidence — IDs, counts, categories, timestamps, and file patterns only. Never prompts, code, commands, or secret values.
  2. Detection is automatic; enforcement is human — revoke / rotate / dismiss decisions stay on an admin or reviewer.
  3. Previews before irreversible actions where the product already requires confirmation (for example key revoke).
  4. Legal hold — compliance retention never deletes under legal hold; lowering compliance retention warns on Control health (RC-AI-10).

​
Control catalog (shipped)

Controls that need later features (vendor register, incidents) are seeded when those features ship so Control health does not show noisy na / fail rows early.

​
Status meanings

​
Access reviews

Admins create a campaign with a label, due date, and scope (gateway keys, org API keys, members). Items freeze a subject snapshot at creation. Team-scoped keys go to a team lead when possible; reviewers cannot decide their own access when another admin exists (single-admin self-review is allowed and recorded as an SoD exception → RC-AI-07 warn). Decisions are keep / revoke / modify / rotate with a required reason. Completing a campaign requires attestation; the product stores completed_by, timestamp, and a SHA-256 of the decision set (no cryptographic signature). Removing a member also creates off-cycle shared key exposure items for team gateway keys the departed member could use but did not create. Reviewers choose rotate or keep (with justification).

​
Risk exceptions

A single register covers kinds such as accepted_finding, dlp_exception, and control_threshold_override. Every exception needs a rationale and an expires_at within 12 months of approval. On expiry, status becomes expired and reversible prior state is restored where applicable. On Signals, Accept risk on an anomaly finding creates an accepted_finding exception and dismisses the finding.