If you are preparing for a SOC 2 Type II audit, your checklist just got longer. Auditors are no longer satisfied with SaaS login logs; they want to know how you control AI coding agents like Claude Code, Cursor, and GitHub Copilot. These tools read production code, touch secrets, and call external services, effectively blurring the line between a developer laptop and a production system. A new guide from ReclaimLLM maps seven common auditor questions to concrete evidence artifacts, helping teams move from vague policies to verifiable data.

The Seven Auditor Questions You Must Answer

The guide breaks down the audit process into seven specific inquiries. First, auditors want a defined standard for approved tools and proof of adherence, not just a PDF policy. They also ask how you prevent sensitive data from reaching AI tools, requiring evidence of preventive controls at the prompt boundary. Access reviews for AI credentials and keys must be periodic and attested, similar to SaaS admin reviews. Monitoring for misuse is critical, with auditors looking for actionable records rather than silent blocking. When controls fail, an exceptions register with owners and dates is required. Finally, log retention must align with policy, and exports must be tamper-evident, often via SIEM webhooks.

Building a Tamper-Evident Evidence Pack

ReclaimLLM’s Compliance tab helps gather this evidence by generating control health snapshots, population counts, and exception lists. Crucially, the tool produces evidence packs containing CSV bundles and a SHA-256 manifest. This manifest lists per-file hashes and a top-level export hash, allowing auditors to verify integrity without reading every single prompt. The guide emphasizes that population entries reference session IDs and file paths rather than full content, which streamlines the sampling process. For example, a population row for control RC-AI-02 might show a session ID and a .env path flagged for a DLP gap, allowing auditors to drill down only into sampled sessions.

Important Caveats on Certification and Scope

It is vital to understand what this tooling does and does not do. ReclaimLLM helps gather evidence but does not certify your organization as SOC 2 compliant. Furthermore, ReclaimLLM’s own SOC 2 Type II is targeted for early 2027 and is not yet certified. The guide also notes that AICPA has published proposed 2027 Trust Services Criteria updates, so controls must be tied to what your specific auditor accepts for the current period. Developers do not see the Compliance tab, so security or platform engineering teams must own the export process.

Key Takeaways

  • Auditors now expect evidence of AI tool usage, including approved tool lists and access reviews for API keys.
  • Use SHA-256 manifests to prove the integrity of exported evidence packs and CSV bundles.
  • ReclaimLLM is an evidence collection tool, not a compliance certification; your auditor’s judgment still rules.
  • Vendor-native logs for GitHub Copilot and Claude Code must be paired with cross-tool session data for coherent sampling.
  • Control health snapshots are computed once per org-local day, not at a fixed clock time like 02:00.

The Bottom Line

Don't wait for the audit to realize your AI tools are a blind spot. Start mapping your agent usage to control populations now, and ensure your evidence exports are hash-verified and ready for review.

Pre-Audit Checklist

  • Approved written standard for AI coding tools.
  • Hooks installed and coverage reviewed.
  • RC-AI controls green or exceptions documented.
  • Access review campaign completed for keys and members.
  • Audit log retention confirmed for 365 days.
  • Evidence pack exported with SHA-256 manifest.
  • SIEM webhook tested with schema 1.0.
  • Vendor logs attached for Copilot, Claude, and Cursor.