Tag: compliance
Claude inference hooks cannot see a screenshot
Anthropic now lets an Enterprise organisation put its own server in front of every prompt and return allow or deny before the model runs. It is the strongest inline control Claude has shipped. It also never receives raw image bytes, so a screenshot of the document you are trying to stop walks straight through, and the failure mode when your server goes down is a setting somebody has to choose.
Claude US-only inference costs 1.1x and that is the cheapest part
The Enterprise console offers one toggle that keeps all model inference in US regions for a 10 per cent surcharge. Underneath it are two independent settings, one of which is a one-way door you set when you create a workspace and can never change. The surcharge is the part everybody reads and the least expensive of the three costs.
The Claude Enterprise admin console has 25 sections and no map
Claude Enterprise puts 25 settings sections behind one nav, grouped into four blocks that do not match how anybody actually governs AI. Here is the whole tree, what each block controls, and the six settings worth opening on your first day as an Owner rather than the twenty-five you will otherwise scroll past.
Why a Claude share link will not open, and what actually works
A shared Claude conversation returns HTTP 200 whether or not you can read it, and the page carries six characters of visible text. Team and Enterprise chats are organization-only by design, attached files never travel with the snapshot, and the one programmatic route is a Compliance API that has no idea what a share link is.
Claude is allowed in regulated finance, but it has no EU data residency
Two objections kill most regulated-finance AI conversations before they start. The first, that Anthropic does not permit Claude for regulated work, is false: Claude for Financial Services exists, banks run it, and the usage policy names finance high-risk, not forbidden. The second is real and almost nobody states it plainly: first-party Claude Enterprise has no EU data residency at all. There is no "eu" inference region and workspace storage is US-only. If you are FCA-regulated, that is the fact to design around, and the only EU route runs through a hyperscaler.
How to log every Claude API call for compliance - native logs into your SIEM
Wire-level AI inspectors price at six figures and infer what audit logs capture exactly. Claude Enterprise exposes three native log surfaces - Audit Logs, Analytics, and OpenTelemetry. Here is how to ship them to Splunk, Datadog, Elastic, Sumo Logic, Microsoft Sentinel, Arctic Wolf, or a roll-your-own pipeline, with the architecture, the credentials, and what the auditor wants to see.
Design patterns for healthcare AI on Claude
A signed BAA makes a Claude healthcare workflow legal, not safe. The engineering work is keeping protected health information away from the model. Three design patterns do most of that: de-identify before the model, keep PHI local, and log what the model saw.
The BAA for Claude Code is narrower than it looks
Is there a BAA for Claude Code? Yes, but the coverage is narrow. A BAA can cover the Claude Code CLI, but only with Zero Data Retention enabled, and the self-serve Enterprise HIPAA toggle does not include it. What is covered, what is not, and why.
How to run Claude in compliance-heavy environments
Running Claude on regulated data is a solved problem in 2026 if you pick the right deployment surface and match it with the right contractual paper. Three architecture patterns cover HIPAA, SOC 2, GDPR, FINRA, FedRAMP, and ITAR. Most compliance objections are fixable, and the real leak paths are almost never the model.
Watch a real SOC 2 audit sample request get handled in 16 minutes
Our external auditor asked for three pull request screenshots mapped to Application Change Testing and Change Management Separation of Duties. I pasted the call transcript into Claude and recorded what happened next. The filename-verification moment alone is worth the watch.
Automating SOC 2 evidence collection with AI and browser automation
Evidence collection is the real bottleneck in SOC 2 Type 2 audits. At Tallyfy, an AI-assisted process with Playwright browser automation collected 99 evidence items across 4 sessions, using date-first naming conventions and typed evidence categories instead of expensive compliance platforms.
Mapping SOC 2 controls to evidence without losing your mind
SOC 2 controls do not map one-to-one with evidence items under the AICPA framework. A single control might need three pieces of evidence, and one evidence item might satisfy four controls. Managing these many-to-many relationships in spreadsheets is how compliance programs break down.
Running your own SOC 2 pen tests with open-source tools
Most companies pay five figures annually for penetration testing they could run themselves. Open-source scanners like Nuclei, testssl.sh, and nmap cover the OWASP Top 10, generate auditor-ready reports, and run monthly on a cron job for zero cost.
Sharing SOC 2 audit assets with auditors using Google Drive
Your SOC 2 compliance repository is where the real work happens. Google Drive is the read-only mirror where auditors browse evidence for 67 controls and 31 policies without touching your source of truth.
SOC 2 and HIPAA overlap for SaaS companies
If you already have SOC 2 Type 2, you have done roughly 60-70% of the work needed for HIPAA compliance. The overlap in access controls, encryption, audit logging, and incident response is large. Here is where the frameworks share ground and what HIPAA adds that SOC 2 does not address.
SOC 2 attestation vs certification and why the distinction matters legally
SOC 2 is not a certification. It is an attestation report issued by a licensed CPA firm expressing a professional opinion about your controls under AICPA standards. Calling it a certification on your website or in sales materials is not just wrong, it can create real legal exposure for your company.
SOC 2 policies as code: markdown, version control, and automated PDF generation
Word documents fail at compliance. We manage 31 SOC 2 policies as markdown files in a Git repository with YAML frontmatter, automated version bumps, and WeasyPrint PDF generation. The auditors get professional PDFs. We get a sane workflow.
SOC 2 risk assessment with AI: 42 risks in structured YAML
A SOC 2 risk assessment requires every risk to have an ID, description, category, likelihood, impact, and mitigating controls. Most companies track this in sprawling spreadsheets. At Tallyfy, we maintain 42 risks in structured YAML files that satisfy the AICPA Trust Services Criteria.
SOC 2 Type 1 vs Type 2 and why Type 2 is where AI automation matters
SOC 2 Type 1 proves your controls exist on paper. Type 2 proves they actually worked over months of real operation under AICPA standards. Most enterprise buyers demand Type 2, and the evidence collection grind is where AI-assisted automation delivers real returns.
SOC 2 vendor management when you cannot get their SOC 2 report
Not every vendor will hand over their SOC 2 report. Some gate it behind enterprise tiers, some do not have one, and some just ignore the request. Your auditor still expects you to manage vendor risk. Here is the workaround that actually satisfies the CC9.2 criteria.
SOC 2 vs ISO 27001 for startups and mid-size SaaS
US buyers want SOC 2 from the AICPA. European buyers want ISO 27001. The two frameworks share roughly 80% control overlap, but which one to pursue first depends on where your revenue comes from right now.
The busywork of SOC 2 evidence collection and how to eliminate it
SOC 2 evidence collection is not intellectually hard. It is tedious, repetitive, and error-prone when done by hand. A Coalfire report found 60 percent of organizations still manage compliance with spreadsheets. The real cost is the organizational overhead of naming, tracking, and chasing sign-offs across 123 evidence items.
Using AI for semi-manual SOC 2 evidence collection
Fully automated SOC 2 evidence collection sounds great until you try it. Half the items need human judgment. Here is how a three-phase guided workflow at Tallyfy collected 99 evidence items across 4 sessions in 4 days, with AI handling orchestration and a human handling the judgment calls.
What a SOC 2 report from your auditor should actually contain
A SOC 2 report follows a standard five-section structure. Knowing what belongs in each section helps you catch errors before sharing the report with customers and gives you the vocabulary to push back on your auditor when something looks wrong.
What SOC 2 actually is and why most explanations get it wrong
SOC 2 is not a certification. It is an AICPA attestation report issued by a licensed CPA firm expressing an opinion about your controls. Most vendor websites, sales decks, and even compliance platforms get this basic fact wrong, and the confusion costs companies real time and money.
Why GRC platforms are less useful now that AI exists
GRC platforms like Vanta and Drata solved the organization problem for compliance teams. But AI solves that same problem and does the actual compliance work too. The value proposition for platforms costing tens of thousands annually is eroding fast when AI can collect 99 of 123 evidence items in four sessions.
How we replaced our SOC 2 compliance platform with AI and Google Drive
SOC 2 compliance platforms charge thousands annually for what is essentially organization software. We moved to a Git repository, Google Drive for auditor access, and AI for the tedious work. The only cheque we write now goes to our CPA firm for the actual audit.
Azure OpenAI vs OpenAI: the enterprise decision
Azure OpenAI offers over 100 Microsoft compliance certifications but trails OpenAI on new platform features and APIs. It is insurance, not improvement. Here is how to choose.
AI governance that enables instead of restricts
Enterprise AI governance frameworks kill mid-size innovation through compliance theater that takes six months to approve any AI initiative. Here is how to build lightweight, NIST-aligned frameworks that accelerate safe AI adoption instead - starting with three core controls that prevent catastrophic failures while enabling teams to ship AI products weekly, not quarterly.
Claude Code SOC 2 compliance - what your auditor needs to know
Your auditor does not care about Anthropic marketing promises or vendor certifications alone. They need evidence of YOUR controls around Claude Code, data handling documentation, and audit trails that prove your AI coding tool is not creating compliance gaps in your SOC 2 framework. IBM found 97% of AI-breached organizations lacked proper access controls.