Why trust pages matter more for an AI SOC
An AI SOC reads the most sensitive data a company has: identity logs, mailboxes, endpoint telemetry, cloud configuration. It then writes verdicts and, sometimes, takes actions. Whatever a vendor publishes about how it handles that data is the starting point for your security review, and for a small team without a dedicated vendor-risk function, a clear trust page can save weeks.
This note summarises what each vendor's trust or security page said when we read it. Most pages were read on 11 October 2026; Dropzone AI's details and Conifers' Singapore region come from pages read on 27 September 2026.
Vendor by vendor
- Mate Security. The trust center lists ISO 27001:2022, SOC 2 Type II, HIPAA, CCPA and GDPR. It offers documents including a SOC 2 Type 2 report, a HIPAA completion letter, an ISO 27001 certificate, a 2026 penetration test report and a disaster recovery drill report. Subprocessors listed include Google Cloud and Amazon Web Services as cloud providers, plus Sentry and Coralogix. Mate's AWS Marketplace post says the platform is built on AWS infrastructure. No single-tenant, customer-tenant or residency option is described.
- Torq. A December 2025 post announced ISO 42001:2023 and German BSI C5 certifications, joining SOC 2 Type 2, HIPAA and ISO 27001. ISO 42001 is a management system standard for AI, which is directly relevant to a product built on agents.
- Dropzone AI. Lists SOC 2 Type II, an EU data residency option and a dedicated single-tenant environment on its Enterprise plan.
- Prophet Security. The trust center lists SOC 2 Type II, ISO/IEC 27001:2022 and ISO/IEC 42001:2023, plus third-party assessments for GDPR, CCPA and HIPAA. Prophet deploys as a dedicated single tenant with a bring-your-own-key option and states it does not train AI models with personal data. Subprocessors include AWS, with processing in the United States, Germany, Switzerland or Japan, Amazon Bedrock and Anthropic for AI, and Datadog. Its data controls list retention procedures and deletion of customer data on leaving, without a stated period.
- 7AI. Says it completed a SOC 2 Type II audit covering security and confidentiality, with Decrypt Compliance as auditor. ISO 27001 is not stated.
- Conifers. Lists SOC 2 Type II and ISO/IEC 27001, with SaaS on Conifers-hosted Azure or private cloud in the customer's own Azure tenant, and all AI inference and processing in the customer-selected Azure region. In July 2026 it opened a Singapore region alongside North America and Europe. It also publishes retention and deletion terms: 24 months by default for operational support, adjustable by contract, and full deletion within two weeks of a written request.
- Intezer. Its security page says it completed a SOC 2 Type II examination, that its platforms are hosted on AWS and Azure, and that tenants are logically separated, with TLS 1.2 in transit and AES-256 at rest. ISO 27001 and retention terms are not stated.
- Exaforce, Artemis Security and Vega. Added to the ranking on 13 October 2026. Exaforce says it stores and normalises raw data in its own data layer, Artemis describes on-premises execution of response actions, and Vega says data stays where it lives; none of the pages we read describes tenancy, residency or security attestations.
What the pattern shows
SOC 2 Type II is the floor among the seven read in October: each of them lists it. ISO 27001 appears at Mate, Torq, Prophet and Conifers, and ISO 42001, the AI management standard, at Torq and Prophet. Beyond attestations, the pages split into two groups. Prophet, Dropzone AI and Conifers describe where and how your data is isolated: single-tenant environments, your own keys, your own cloud tenant or region. Mate, Torq, 7AI and Intezer describe their certifications and, in some cases, their cloud providers, but not a choice of tenancy or location.
That split is why our hosting and data handling criterion puts Conifers at the top and Mate in the middle, even though Mate's trust center lists more frameworks than most.
What is still missing almost everywhere
Only Conifers publishes how long data is kept and how fast it is deleted, and Prophet lists deletion on exit as a control without a period. No vendor page we read says how long agent memory and learned context are retained, or how a customer deletes what the platform has learned about its environment. For an AI SOC that keeps memories and decision histories, those are the questions that matter most after the contract ends.
Questions to send before the first call
- Which subprocessors handle our data, and in which regions?
- Is our environment single-tenant or multi-tenant, and can that change by plan?
- Can we supply our own encryption keys?
- How long are alerts, investigation records and learned memories retained, and how are they deleted at the end of the contract?
- Is any of our data used to train models shared with other customers?
- Can we read the SOC 2 report under NDA before the pilot starts?
How this affects the scores
Hosting and data handling carries 10% of the hand-off score. It rarely decides whether a platform can do the work, but for a lean team it often decides whether the purchase gets approved this quarter or next.
One practical tip: ask each vendor for its standard security questionnaire answers before the first call. A vendor with a published trust center can usually send them the same day, and the answers fill most of the gaps listed above.