Methodology
This page lists control themes that show up on SOC 2, GDPR, and HIPAA questionnaires for LLM products. It is not a record of audits performed by Mansoori Technologies, and it is not a certification.
Key findings
The numbers we keep coming back to
The signals that shaped the rest of the analysis — each one is summarized with the methodology above.
Auth
Who can read a record
Access rules belong in the design. This page does not certify that design.
Logs
A trail you can explain
Prompts, tool calls, and the decision a person made are questionnaire topics. We do not claim an audit practice.
Vendors
Where data goes
Name the model vendor and what it is allowed to retain. That is scope, not a HIPAA credential.
Secrets
Keys out of the client
The same check we run on an AI-built MVP: keys, environments, and a deploy that can be repeated.
Quote
Not a certification
We do not claim HIPAA, SOC 2, or GDPR certification. A fixed price comes after we see the repo.
Inside the report
8 chapters of research
A scannable chapter guide of what the full write-up covers.
01
Threat-modeling AI systems
Prompt injection, data exfiltration, model poisoning, and supply-chain risks mapped to concrete controls.
02
Data governance for training and inference
Retention, redaction, and purpose limitation requirements under GDPR and HIPAA, with template DPIA.
03
SOC 2 controls for AI systems
The 12 auditor-standard controls, with acceptance criteria, evidence, and example policy language.
04
HIPAA specifics for LLM-powered tools
BAA coverage, PHI handling, and de-identification pipelines that survive audit scrutiny.
05
GDPR and automated decisioning
Article 22 obligations, human-in-the-loop design, and right-to-explanation implementations.
06
Audit trail and observability requirements
Per-inference logging, prompt/response retention policies, and PII-safe telemetry patterns.
07
Third-party and model vendor review
How to assess OpenAI, Anthropic, AWS Bedrock, and Azure OpenAI under a formal vendor-risk program.
08
AI incident response playbook
From first prompt-injection report to root-cause remediation and disclosure timelines.
Full report
Request a copy of the 52-page report
The PDF is not published on this site. Tell us which report you need and we will follow up.