The right requirements.
The evidence to decide.

Request the current full report, auditor opinion, period, exceptions, subservice carve-outs and customer controls.

Braintrust's public product page describes SOC 2 Type II and annually audited security controls. This is a vendor assertion: GovernAtlas has not inspected the underlying auditor opinion, reporting period, exceptions or system boundary.

Obtain the current document and confirm AI Command Center, purchased features, entities, cloud regions, dates and exclusions are covered.

Collibra's company trust center lists SOC 2 among its organizational certifications and attestations. GovernAtlas has not reviewed the underlying document or established that its precise scope covers AI Command Center; a company-wide listing must not be treated as product-specific assurance.

Inspect the current policy-pack version, control mappings, evidence exports and reviewer responsibilities; do not infer assurance from a supported framework.

Credo AI's product page describes pre-built SOC 2 policy packs, automated governance workflows and evidence generation. This is a vendor-described support capability, not evidence that Credo AI or a customer has passed a SOC 2 assessment.

Credo AI presents policy packs and controls mapped to the EU AI Act, NIST AI RMF, ISO/IEC 42001 and SOC 2. Scope: vendor-described governance content. Framework mapping is not certification or a finding that a customer meets those requirements.

Request the current report and map its system boundary to Cloud versus installed software and the controls remaining with your team.

Dataiku states that it has completed SOC 2 Type II assessments and directs customers to an account representative for the report. GovernAtlas has not reviewed the report's period, opinion, exceptions or service coverage; the statement does not establish assurance for every self-managed deployment.

Obtain the current report and reconcile the exact SaaS service, regions, integrations and customer controls.

DataRobot's trust page states that its cloud control environment undergoes an annual SOC 2 Type II assessment. GovernAtlas has not reviewed the report, operating period, auditor opinion or exceptions, and does not extend cloud assurance to every deployment model.

Request the report through the appropriate confidentiality process and compare the purchased deployment and customer controls with its scope.

Fiddler describes an annually audited SOC 2 Type II report covering Security, Confidentiality and Availability, available to customers and prospects under NDA. GovernAtlas has not obtained that report or reviewed its period, opinion, exceptions and system boundary.

Helicone's pricing page lists SOC 2 and HIPAA compliance with the Team plan, with Enterprise inheriting Team features. Scope: vendor-advertised plan support. This source does not establish BAA execution, eligible downstream providers or a compliant healthcare configuration.

HoneyHive's pricing FAQ asserts HIPAA, GDPR and SOC 2 Type II compliance and says data is encrypted at rest and in transit. These are vendor assertions; GovernAtlas has not reviewed an assurance report or tested the controls.

Obtain the complete report and determine whether the commercial or separate government environment is in scope.

Hyperproof's security FAQ describes SOC 2 coverage for Security, Availability and Confidentiality. GovernAtlas has not reviewed the auditor report or established its type, period, exceptions and exact system boundary from that public statement.

Request the full current report and compare the SaaS services, integrations and complementary customer controls.

Immuta's trust page lists SOC 2 Type 2 assurance. GovernAtlas has not reviewed the underlying report, audit period, opinion or exceptions; the public label alone does not establish the precise service boundary or customer configuration.

Request the current report and reconcile cloud service boundaries, reporting period, subservice organizations and customer controls.

Langfuse documents completion of a SOC 2 Type II audit for Langfuse Cloud and makes the report requestable on Pro, Team or Enterprise plans. GovernAtlas has not reviewed the restricted report, period, auditor opinion or exceptions; this statement is not an assessment of self-hosted installations.

Langfuse's compliance FAQ states that its cloud offering supports SOC 2 Type II, ISO 27001 and GDPR requirements and offers a HIPAA-ready region. These remain supplier assertions; GovernAtlas has not inspected an auditor's report or determined regulatory compliance.

Obtain the actual document and reconcile service, deployment, hosting region and customer-operated infrastructure with its scope.

LangChain's EMEA page states SOC 2 Type 2 assurance for LangSmith and directs buyers to its trust center for supporting documents. GovernAtlas has not reviewed the underlying report or certificate, current validity, exceptions or coverage across cloud, hybrid and self-hosted offerings.