GATEKEEPER AI AGENTS
SOC 2 Review Agent.
Before your security team can assess a vendor's controls, someone has to read a dense SOC 2 report, extract the relevant details, and check whether the coverage meets your requirements.
The SOC 2 Review Agent extracts and validates this information as soon as reports are submitted, so your team engages only on material findings.
SOC 2 Review Agent in action.
See how the agent extracts and validates information as soon as reports are submitted.
HOW IT WORKS
How the SOC 2 Review Agent works.
Report submission.
A vendor submits their SOC 2 report through Gatekeeper.
Report review.
The agent reviews the report fundamentals: report type, period covered, auditor, and service organisation scope.
Requirement flag.
It checks which trust service criteria are covered (Security, Availability, Confidentiality, Processing Integrity, Privacy) and flags any that are missing from your requirements.
Context & impact.
Exceptions, deviations, and qualified opinions are extracted and surfaced with context on their potential impact.
Configured requirements.
Report age and suitability are verified against your configured requirements, such as Type II coverage within an acceptable timeframe.
Review focused.
Clear findings and flagged exceptions help your team focus further review where it is needed.
FAQ
Frequently asked questions.
What does the SOC 2 Agent review?
The Agent reviews the key elements of each SOC 2 report against your defined requirements, including:
- Report type, period, auditor and scope
- Trust service criteria covered
- Exceptions, deviations and qualified opinions
- Report recency and suitability
What does the Agent extract from a SOC 2 report?
Report type, period, auditor, scope, trust service criteria coverage, exceptions, deviations, qualified opinions, and report age.
Each finding is structured so your team can review it without reading the full document.
What are the configuration options?
Configure the Agent to reflect your organisation’s security evidence requirements, including:
- Accepted report types
- Required trust service criteria
- Report currency and coverage periods
- Exception handling
- Summary structure
How does it handle exceptions?
The agent extracts every exception and deviation from the report and presents them with context. Your team decides which exceptions are material for your use case.
Does it work with both Type I and Type II reports?
Yes. The agent processes both types and notes which one was submitted, so your team can confirm it meets your minimum requirement.
How does Agent automation compare with a manual process?
Without Agent automation, teams manually review SOC 2 reports from start to finish.
- Lengthy reports require full manual reading.
- Key details and exceptions must be located and interpreted.
- Review backlogs can form as report volumes increase.
With Agent automation, SOC 2 reports are analysed automatically when submitted.
- Key metadata and exceptions are extracted immediately.
- Coverage and requirements are validated consistently.
- Teams focus their review on material findings.
Is there an audit trail?
Every Agent action is recorded in Gatekeeper with a timestamp, including the criteria applied, decision made, supporting evidence and reasoning where applicable.
This creates a searchable record of how each outcome was reached, supporting compliance verification, internal review and audit requirements.
How is my data kept secure and compliant?
Your data stays within Gatekeeper while the Agent performs its work. Actions, decisions and supporting evidence are logged, creating a clear audit trail.
The Agent operates within the permissions, playbooks and authority controls you configure.
Data handling follows Gatekeeper’s enterprise security standards, including SOC 2 Type II compliance and GDPR requirements.
one unified record
Every capability, unified.
One system of truth.
Customer and vendor contracts, obligations, and renewals in one record.
See spend against contract.
Contract value sits next to what is actually being spent.
No single point of failure.
Contract knowledge lives in the platform, so nothing is lost when someone changes role or leaves.
Draft from approved templates.
Every agreement starts from language Legal already trusts.
Keep control of the clause library.
Guard-railed templates keep off-policy wording from going out.
Nothing renews unnoticed.
Every renewal date tracked, with owners and reminders set automatically.
Expert insight & opinion
Related AI agents.
Gatekeeper's agents work as a single, connected team, handing off to one another across the lifecycle rather than running in isolation like bolted-on point tools.
