FluxyChatEnterprise
SOC 2 readiness checklist
Self-assessment checklist mapping SOC 2 Trust Services Criteria to FluxyChat controls, exports, and dashboard surfaces.
Use this checklist before engaging a CPA firm for SOC 2 Type I or II. FluxyChat ships product controls and evidence exports. A signed attestation still requires an external auditor.
Self-assessment export
Dashboard SOC 2: click Export self-assessment JSON.
Or API:
curl "$WORKER_URL/api/soc2/self-assessment" \
-H "Authorization: Bearer $ADMIN_JWT"Returns:
summary.readinessScore: automated signal coverage (not a pass/fail audit)checklist: TSC items with FluxyChat module mappingdashboard,controls,evidence,policiessnapshots
Store exports in evidence/YYYY-MM-DD/ with your change log.
Trust Services Criteria coverage
| TSC area | FluxyChat surfaces |
|---|---|
| Security | JWT auth, RBAC, DLP, audit export, incidents, agent tool policy, EU AI Act |
| Availability | Upptime status page, Cloudflare edge, retention/backup exports |
| Processing integrity | Message idempotency, delivery ack, audit chain |
| Confidentiality | E2E/MLS, data residency, CMK options |
| Privacy | GDPR export/delete, consent/DPA, retention/legal hold |
Weekly operator cadence
- Refresh
/soc2dashboard - Export evidence JSON and audit log
- Export self-assessment JSON
- Run DLP smoke test
- Review open incidents and risks
What auditors still need from you
- Signed policies (HR, access review cadence)
- Vendor risk assessments (subprocessors list)
- Penetration test report (annual)
- Formal SOC 2 Type II report from a licensed CPA (Type II engagement guide)