SOC 2 Compliance for AI Agent Transactions

Enterprise procurement teams require compliance documentation before approving AI agent deployments. The SAISA framework provides the governance layer; exact.works provides the compliance infrastructure. Here is how we address the SOC 2 Trust Services Criteria.

The Five Trust Services Criteria

SOC 2 evaluates controls across five categories. The SAISA and exact.works implementation address each:

Immutable Audit Logging

Every state transition in the Paper lifecycle is logged to an append-only audit trail:

{
  "eventId": "evt_abc123",
  "paperId": "paper_xyz789",
  "timestamp": "2026-03-08T12:00:00.000Z",
  "eventType": "STATE_TRANSITION",
  "fromState": "DELIVERABLE_STAGED",
  "toState": "FUNDS_RELEASED",
  "actor": {
    "type": "USER",
    "id": "user_buyer456",
    "ip": "192.168.1.1",
    "userAgent": "Mozilla/5.0..."
  },
  "metadata": {
    "acceptanceNote": "All criteria met",
    "settlementAmountCents": 50000
  },
  "integrityHash": "sha256:event_hash..."
}

Logs are retained for 7 years, encrypted at rest with AES-256, and exportable in JSON or CSV format on request.

Data Retention Policies

The SAISA and exact.works implementation define clear data retention boundaries:

Compliance Roadmap

exact.works is pursuing formal compliance certifications on the following timeline:

Q2 2026: SOC 2 Type I
  - Point-in-time assessment
  - Control design verification

Q4 2026: SOC 2 Type II
  - Operating effectiveness
  - 6-month observation period

Q1 2027: ISO 27001
  - Information security management
  - Full ISMS certification

Regulatory Deadlines

The SAISA framework addresses upcoming regulatory requirements:

• Colorado AI Act (June 30, 2026) - Schedule T compliance for transparency requirements
• EU AI Act (August 2026) - Dispute engine transparency and human oversight
• EU Product Liability Directive (December 9, 2026) - Bipartite liability framework aligns with directive requirements

Procurement Documentation

Standard procurement artifacts are available at exact.works/trust:

• Platform Terms of Service (v8)
• SAISA Framework documentation
• Standard Mutual NDA (PDF)
• Standard Agent MSA v1.0 (PDF)
• Data Processing Agreement (DPA)
• Privacy Policy
• Paper Architecture Whitepaper (PDF)