SOC 2 Certifies Their Data Center. It Doesn't Certify What Happens to Your Data Inside It.
The Gap Between Infrastructure Certification and Data Processing Accountability
---
Your AI vendor is SOC 2 Type II certified. Their data center passed every control test. Their security team ran the audit. The certificate is real. None of that tells you where your financial data goes after you submit a query, who at the vendor can access it, whether it is used to train their models, or how long it is retained after your contract ends.
Think of SOC 2 as the building inspection for a bank vault. The inspection confirms the vault is structurally sound, the locks work, and the alarm system functions. It says nothing about who has a key, what they do inside, or whether they make copies of what they find. The building passed inspection. What happens inside the building is a different question entirely.
This gap — between the security of the infrastructure and the governance of what happens to data on that infrastructure — is where the real financial data risk lives. And in finance procurement, we have been asking the wrong question.
---
What SOC 2 Actually Certifies
SOC 2 evaluates vendors against five Trust Service Criteria: security (are systems protected from unauthorized access?), availability (do systems stay online?), processing integrity (are outputs accurate and complete?), confidentiality (is data protected from unauthorized disclosure?), and privacy. Here is the detail most procurement processes miss: the privacy criterion is optional. A vendor can achieve full SOC 2 Type II certification without having their privacy practices independently assessed at all.
Most AI vendors certify against security and availability — the two criteria that confirm their servers are locked down and their systems stay online. Processing integrity and confidentiality are selected by some vendors. Privacy — which would cover data collection practices, use rights, and retention — is an optional add-on that most vendors do not include in scope.
When your IT team confirms an AI vendor is "SOC 2 Type II certified," that confirmation almost certainly means their infrastructure security and availability were audited. It says nothing about what the vendor does with your financial data once it arrives.
---
The OpenAI Example Worth Naming
OpenAI holds SOC 2 Type II certification. That certification did not prevent the March 2023 incident where a bug exposed ChatGPT Plus users' conversation history, payment method last four digits, names, and email addresses to other users. The certificate confirmed the infrastructure had security controls. The incident happened because of a software bug — meaning the technical controls passed the audit, and the data exposure happened anyway.
Samsung's engineers who pasted chip designs into ChatGPT that same month were operating on a SOC 2 certified platform. Three separate incidents in a single month. The certificate was accurate. It was not sufficient.
Consider what this means practically: infrastructure security audits were never built to evaluate data processing accountability for AI systems. They are being applied to that purpose because they are the available third-party assurance — not the right one.
---
The GDPR Requirement That SOC 2 Doesn't Address
GDPR Article 28 requires a signed data processing agreement (DPA) with every third party that processes personal data on your behalf. The DPA must specify the purposes of processing, the categories of data involved, retention periods, the complete list of sub-processors with their jurisdictions, and deletion procedures at contract end.
This requirement applies to your AI vendor the same way it applies to your payroll processor or your document management platform. A signed DPA is a legal requirement, not a security best practice. Operating without one: up to €10 million or 2% of global annual turnover under GDPR Article 83(4).
Certification produces none of this. It does not document processing purposes. It does not list sub-processors or their jurisdictions. It does not define retention or deletion procedures. Both frameworks matter. Neither substitutes for the other.
EU AI Act Articles 9, 12, and 17 add further requirements that are separate from both: risk management documentation, automatic logging of AI system operations, and quality management systems for high-risk AI applications in financial services. A finance team's AI vendor review now needs to address three distinct regulatory frameworks — and only one of them, SOC 2, is typically checked in the procurement workflow.
---
The Silent Expansion of Data Use Rights
Finance teams conducting AI vendor data reviews rarely find dramatic breaches. What they find instead is a clause in the vendor's current terms of service permitting use of customer data for AI model improvement — a clause added in a terms update the customer accepted by continuing to use the service.
These updates arrive as email notifications. Legal teams rarely flag them as material because they arrive in a standard terms-of-service notification format. The clause is legal. The customer agreed to it. The SOC 2 certificate on the procurement file did not change. The data use rights expanded without anyone in finance knowing.
Once financial data has been processed by a cloud AI system, it cannot be recalled. You can terminate the contract. You can request deletion under GDPR Article 17 (the right to erasure — a formal request that the vendor delete all copies of your data). You cannot remove data from model weights if it was used for training before your deletion request. Data governance answers best before the data leaves your infrastructure — after that, you are in remediation mode.
France's CNIL (the French data protection authority) issued €3 million in AI-related fines in 2024 alone, and France is one of the most active data protection authorities in Europe. Organizations using AI vendors without compliant DPAs are operating exposed to CNIL investigation today, with a penalty ceiling of €20 million or 4% of global annual turnover.
---
The Accountability That Stays With You
Under GDPR, data controllers — the organizations whose data is processed, not the vendors — bear ultimate accountability for ensuring processors operate under compliant agreements. The DPO (Data Protection Officer — the person legally responsible for your organization's GDPR compliance) signs off on processor relationships. The CFO approves vendor contracts. When an AI vendor relationship exists without a compliant DPA, both carry a shared accountability gap that regulators can and do investigate.
Statutory auditors now ask about third-party processor agreements as part of standard financial audit procedures. An AI vendor without a compliant DPA appears as a control gap in the auditor's working papers — carried forward to the management letter and potentially to the audit committee. Organizations that can produce complete AI vendor governance documentation close these findings in days. Organizations that cannot spend audit time reconstructing agreements and processing histories — time that costs money and creates findings even when no actual harm occurred.
For companies subject to SOX Section 404 (the US Sarbanes-Oxley Act's requirement for management to assess internal financial controls — relevant if your company is US-listed) or DORA (the EU's Digital Operational Resilience Act — which requires EU financial entities to formally manage technology provider risk from January 2025): any AI vendor used in financial preparation workflows is a component in the internal controls scope. An undocumented component with unclear data processing controls is a reportable gap.
---
Five Documents to Request Before Any AI Contract Touches Financial Data
Effective AI vendor evaluation is not binary — certified or not certified. It is a five-part review:
A GDPR-compliant DPA that specifically covers AI processing, not just general data handling. The data processing legal basis documented — either a legitimate interests assessment (a formal analysis showing the vendor's data use is justified and doesn't override the rights of the people whose data it is) or an explicit consent mechanism. A complete sub-processor list with jurisdictions — the primary vendor and every downstream service they use to process your data. A defined retention and deletion policy covering what happens to your data at contract end and under an Article 17 deletion request. An AI training data policy that explicitly excludes client data from model training.
None of these five questions are answered by a SOC 2 certificate. A vendor who responds to these requests with their certificate rather than the documentation has told you something important about their readiness for financial data governance.
---
When the Question Disappears Entirely
Certifications tell you the building is secure. They do not tell you what vendors do with your data once it is inside.
An architecture where financial AI runs on your own infrastructure makes this question unnecessary — the relevant party in the vendor certification question is you, and you are already subject to that assessment in every statutory audit you undergo. When data never leaves your environment, there is no sub-processor list to request because there are no sub-processors. There is no AI training data policy to evaluate because the only system training is yours. The DPA is with yourself.
Organizations that have moved financial AI to sovereign infrastructure are finding that the GDPR compliance conversation with auditors becomes straightforward: all processing is within the organization's existing control scope, audit trails are on systems the organization controls, and the vendor certification question is replaced by the organization's own security posture — already reviewed, already documented.
Architecture, not positioning.
Phase 1 of a reasonable remediation for any finance team: audit all current AI vendor relationships in the next two weeks and identify which have signed DPAs covering AI processing specifically. Phase 2: within 30 days, request compliant DPAs from vendors who lack them. Phase 3: within 60 days, evaluate vendors who cannot produce compliant documentation for replacement. Phase 4: migrate financial AI to infrastructure you control — where the vendor compliance question is permanently resolved.
Procurement teams that ask "what are your security certifications?" are asking a real question. The question that matters more is: "what is your AI training data policy, and may I see your sub-processor list?" That answer reveals what the certificate left open.
---
Stralevo is an AI intelligence layer for finance, built on EU-sovereign infrastructure with full GDPR compliance documentation, no US sub-processors, and an explicit policy against training on client financial data. Your data stays in your environment. The vendor certification question does not arise.