How to Answer
“They’re two different asks and it’s worth separating them, because customers say them in one breath.
SOC 2 is mostly evidence, not architecture — access control with reviews, change management, logging and monitoring, vendor management, incident response, and being able to demonstrate all of it across an observation window. The part specific to us is that the model provider, the vector database and the tracing vendor are all subprocessors, and the auditor will ask for that list.
Residency is architecture. Every hop in-region: model endpoint, vector index, the object store holding source documents, the traces, the queues, the backups. The one that catches people is that a vendor’s global control plane often routes metadata through another region, and ‘metadata’ includes prompts more often than anyone would like.
So the practical answer is a region-pinned deployment per residency zone, rather than one global system with a region column — because the second one leaks, and you can’t prove that it doesn’t.”