SOC 2 Controls

Anima provides built-in SOC 2 Type II controls and automated evidence collection for AI agent operations. The platform maps its security features to Trust Service Criteria, making audit preparation straightforward.

Trust Service Criteria Mapping

Anima covers controls across all five Trust Service Categories:

Security (Common Criteria)

Control ID	Control	Anima Feature
CC6.1	Logical access security	Pod isolation, API key scoping
CC6.2	Authentication mechanisms	DID-based auth, API key rotation
CC6.3	Authorization and access controls	Role-based permissions, budget guards
CC6.6	System boundary protections	Pod network isolation, MCC controls
CC7.1	Monitoring for anomalies	Anomaly detection, behavioral baselines
CC7.2	Activity monitoring and alerting	Audit log, SIEM integration
CC7.3	Evaluating security events	Quarantine, incident response workflows
CC8.1	Change management	API versioning, configuration audit trail

Availability

Control ID	Control	Anima Feature
A1.1	Capacity management	Pod resource limits, rate limiting
A1.2	Recovery procedures	Automated backups, disaster recovery

Confidentiality

Control ID	Control	Anima Feature
C1.1	Identification of confidential data	Vault encryption, secret classification
C1.2	Disposal of confidential data	Vault secret expiration, secure deletion

Viewing Controls Status

Tab Title
Tab Title
Tab Title

import { Anima } from "@anima-labs/sdk";

const anima = new Anima({ apiKey: "ak_..." });

// Get SOC 2 controls status
const controls = await useanima.shpliance.soc2.listControls();

for (const control of controls.data) {
  console.log(`${control.id}: ${control.name}`);
  console.log(`  Status: ${control.status}`);        // "passing" | "failing" | "not_evaluated"
  console.log(`  Evidence: ${control.evidenceCount} items`);
  console.log(`  Last evaluated: ${control.lastEvaluatedAt}`);
}

from anima import Anima

anima = Anima(api_key="ak_...")

controls = useanima.shpliance.soc2.list_controls()

for control in controls.data:
    print(f"{control.id}: {control.name}")
    print(f"  Status: {control.status}")
    print(f"  Evidence: {control.evidence_count} items")

import "github.com/anima-labs-ai/go"

client := anima.NewClient("ak_...")

controls, err := client.Compliance.SOC2.ListControls(ctx)
for _, c := range controls.Data {
    fmt.Printf("%s: %s -- %s\n", c.ID, c.Name, c.Status)
}

Evidence Collection

Anima automatically collects evidence for each control from audit logs, configurations, and system state:

// Get evidence for a specific control
const evidence = await useanima.shpliance.soc2.getEvidence("CC6.1", {
  startDate: "2026-01-01",
  endDate: "2026-03-31",
});

for (const item of evidence.data) {
  console.log(`[${item.timestamp}] ${item.type}: ${item.description}`);
  console.log(`  Source: ${item.source}`);
  console.log(`  Artifact: ${item.artifactUrl}`);
}

Evidence Types

Type	Description
`configuration`	System configuration snapshots proving control state
`audit_event`	Audit log entries demonstrating control enforcement
`policy_document`	Automatically generated policy documentation
`test_result`	Results of automated control tests
`access_review`	Periodic access review records

Continuous Monitoring

Controls are continuously evaluated, not just at audit time:

// Configure continuous monitoring
await useanima.shpliance.soc2.configureMonitoring({
  evaluationInterval: "1h",  // How often to re-evaluate controls
  alertOnFailure: true,
  alertChannels: [
    { type: "email", address: "compliance@acme.com" },
    { type: "slack", webhookUrl: "https://hooks.slack.com/..." },
  ],
});

// Get monitoring dashboard data
const dashboard = await useanima.shpliance.soc2.getDashboard();
console.log(`Controls passing: ${dashboard.passing}/${dashboard.total}`);
console.log(`Last full evaluation: ${dashboard.lastFullEvaluation}`);
console.log(`Audit readiness score: ${dashboard.readinessScore}%`);

API Reference

Endpoint	Method	Description
`https://api.useanima.sh/api/compliance/soc2/controls`	GET	List all SOC 2 controls and status
`https://api.useanima.sh/api/compliance/soc2/controls/:id`	GET	Get a specific control
`https://api.useanima.sh/api/compliance/soc2/evidence`	GET	Query evidence by control and date
`https://api.useanima.sh/api/compliance/soc2/evidence/export`	POST	Export evidence package
`https://api.useanima.sh/api/compliance/soc2/monitoring`	PUT	Configure continuous monitoring
`https://api.useanima.sh/api/compliance/soc2/dashboard`	GET	Get compliance dashboard data

Configuration

Variable	Default	Description
`ANIMA_SOC2_EVALUATION_INTERVAL`	`1h`	Control evaluation frequency
`ANIMA_SOC2_EVIDENCE_RETENTION_DAYS`	`730`	Evidence retention period (2 years)
`ANIMA_SOC2_ALERT_ON_FAILURE`	`true`	Alert when a control starts failing

Next Steps

Compliance Reporting — Generate audit-ready reports
Audit Log — Underlying event data for evidence
Anomaly Detection — CC7.x control implementation

​SOC 2 Controls

​Trust Service Criteria Mapping

​Security (Common Criteria)

​Availability

​Confidentiality

​Viewing Controls Status

​Evidence Collection

​Evidence Types

​Continuous Monitoring

​API Reference

​Configuration

​Next Steps