compliance · soc 2 · audit · snapshot 2026-09-28
Does Jev have SOC 2? The honest status, and the buyer checklist
A direct answer on Jev and SOC 2 — no public report as of October 2026 — with what the legal documents do cover, a trust-services-criteria mapping, and the vendor-review checklist to run instead.
TL;DR
No. As of the 2026-09-28 snapshot of TypeSafe's legal documents, Jev has no published SOC 2 (Type I or Type II) report and no ISO 27001 certificate. What exists instead is contractual: a DPA with SCCs, a 72-hour breach-notice clause, a subprocessor list with a 15-day objection window, annual security audits, a no-training commitment, and enterprise zero data retention on request. So run the buyer checklist below, generate your own per-decision audit evidence, and if data-plane control is non-negotiable, self-host a wire-compatible alternative.
Fact snapshot 2026-09-28 (shared with our data-privacy guide): the developer-documentation index contains no security or compliance page; the legal index, DPA, and privacy policy were read directly. This page maps public AICPA Trust Services Criteria onto that record — engineering orientation, not a compliance verdict and not legal advice. Trust pages change: verify trust.typesafe.ai before you rely on it.
Does Jev have SOC 2? The direct answer
The question procurement actually asks, answered from the documents rather than from marketing.
Published — the audit-relevant record
- A DPA with substance: EU SCCs (Module 2, plus Module 3 when you act as a processor), the UK Addendum, breach notice "within 72 hours", and security audits "no more than once every 12 months".
- A subprocessor list at trust.typesafe.ai/subprocessors with a 15-day objection window — snapshot it at signature and diarize the window.
- A no-training commitment in the privacy policy: "We will not train or fine tune any artificial intelligence or machine learning models on your prompts or other Input."
- Enterprise zero data retention (ZDR), announced on the legal index itself, via sales@typesafe.ai.
Not published anywhere official
- No SOC 2 report of either type — nothing to attach to your vendor-risk file.
- No ISO 27001 certificate, and no certification claims anywhere in the legal documents.
- No audit-scope description, no auditor name, no bridge letter — there is nothing to bridge.
- No published SLA, encryption specification, or penetration-test summary for the hosted endpoint.
What a buyer does instead
- Email sales@typesafe.ai and ask directly for the current audit or certification roadmap — then get every answer you rely on written into the signed DPA.
- Verify what trust.typesafe.ai shows today; our snapshot is 2026-09-28 and trust pages move.
- Generate your own evidence: log every production decision (the record schema below) so an auditor samples your log, not a vendor PDF you do not have.
- If your regulator or customer contract requires a certified vendor, treat hosted Jev as a compensating-controls case — or self-host the data plane.
Mapping SOC 2 criteria to the Jev record
The five Trust Services Criteria families, scored against what a buyer can actually point to — public documents and published contracts only.
| Criteria family | What the record gives you | Status |
|---|---|---|
| Security (common criteria) | Contractual substance only: the DPA commits to security audits "no more than once every 12 months", a named subprocessor list with a 15-day objection window, and breach notice "within 72 hours". No audit report itself is public. | Contractual |
| Availability | Silent in the documents we read: no published SLA, uptime target, or status-page commitment for the hosted endpoint. This is the family where the official record gives you the least. | Silent |
| Processing integrity | The API contract itself is the evidence: single-shot requests return typed answers with a probability distribution, a confidence value, and token usage — no generation step that can hallucinate between you and the decision. Determinism per version is documented behavior, not a certified process. | Documented |
| Confidentiality | The privacy policy commits to never training on your prompts or input; enterprise zero data retention (ZDR) is announced on the legal index. Encryption specifics, key management, and access controls are not published. | Contractual |
| Privacy | The DPA carries EU SCCs (Module 2, plus Module 3 when you act as a processor) and the UK Addendum, a subprocessor list, and "as long as necessary" retention; the privacy policy discloses U.S. transfer for international visitors. No GDPR data-subject-rights section exists in the policy. | Contractual |
Engineering orientation, not a compliance verdict: a contract clause is evidence of process, not proof of control operation, and "documented" means the API reference describes the behavior — not that an auditor has tested it. The mapping covers the hosted Typesafe endpoint; open-source alternatives carry their own (usually weaker) record — laya.studio's own FAQ discloses "no formal certification (such as ISO 27001) today".
Build the decision-log schema the checklist asks your vendor forWhy a decision model is easier to audit than a chat assistant
The audit-surface argument you can make to a risk committee while the certification question stays open.
A chat LLM turns your prompt into generated text, so every audit question inherits generation's failure modes: what did it say, why, what did it omit? A Jev call has no generation step to audit — the response is a typed answer with a probability distribution, a confidence value, and token usage, over a criteria set you defined in the request.
The request surface is small and fully legible: model, state, and questions. The question keys you name are documented as "not sent to the underlying model and not used in inference", so your internal taxonomy stays on your side of the boundary. There is no session or conversation object — each call stands alone, which makes per-decision logging natural rather than bolted on.
That is why the honest position is: the architecture makes evidence cheap, while the certification makes evidence someone else's job. Until the second part changes, own the first part.
// One record per production decision — the evidence you own
{
"ts": "2026-10-31T09:14:22.481Z",
"decision_id": "dec_01JA8...",
"model": "jev-latest",
"endpoint": "https://api.typesafe.ai/v1/evaluate",
"state_digest": "sha256:9f2c…", // hash of the input, not the input
"question": "route", // your key — not model-facing
"answer": "billing",
"probabilities": { "billing": 0.94, "technical": 0.05, "account": 0.01 },
"confidence": 0.92,
"latency_ms": 147,
"usage": { "input_tokens": 212, "output_tokens": 84 },
"policy": { "threshold": 0.80, "on_low": "human_review" },
"outcome": "auto|escalated" // filled by your gateway afterwards
}One JSON record per production decision, written by your gateway: hash the state instead of storing it, keep the policy that gated the decision, and record the outcome path (auto vs escalated). Six months of these logs answers "show me how this system behaves" better than a Type I report ever could. The full schema and retention guidance live in the decision audit-trail recipe.
Why typed decisions behave differently from generated textThe vendor-review checklist
Eight checks to complete before Jev touches production data — most take minutes; two require an email.
Read all three legal documents end to end (legal index, DPA, privacy policy) — they are short and they are the actual record.
Ask sales@typesafe.ai for the current certification status and roadmap; log the answer with a date.
Ask for a security whitepaper or architecture overview; if none exists, that is a finding.
Get ZDR in writing if your data cannot be retained — the legal index announces it, the signed DPA must bind it.
Snapshot trust.typesafe.ai/subprocessors at signature date and diarize the 15-day objection window.
Confirm the breach-notice clock ("within 72 hours") and who is notified on your side.
Pin the model version in production and record it in your audit log — determinism claims are per version.
Decide your fallback before you need it: what happens to the feature if procurement blocks hosted Jev next quarter? (Self-hosted alternatives are the usual answer.)
Checks 1, 5, 6 and 7 are verifiable today from public documents; checks 2, 3 and 4 are the two emails and their replies; check 8 is a product decision, not a compliance one.
Verify the API contract yourself before you rely on itCompensating controls you can ship without waiting
Four controls that shrink the gap a missing report leaves — all four are in your hands, not the vendor's.
Minimize before you send
PII minimization middleware shrinks what can be retained, breached, or subpoenaed. If the payload holds no direct identifiers, most data questions become smaller questions.
Log every decision
The per-decision record above is evidence an auditor can sample. Confidence plus the policy that gated the action reconstructs any decision months later.
Gate transfers explicitly
The privacy policy discloses U.S. transfer for international visitors. If your residency requirements are stricter, the decision to route — and its recorded justification — should be typed, not a convention.
Self-host the data plane
When a customer contract requires a certified vendor for the data plane, wire-compatible open alternatives (Laya, Kev, JevK5, …) keep the protocol and move the evidence burden to infrastructure you control. Know the accuracy trade-off before you switch.
Order matters: minimize and log first (they help in every scenario), then gate residency, and only then consider moving the data plane — the open models still trail the hosted model on independent benchmarks.
When data-plane control is non-negotiable: the self-host matrixSOC 2 questions buyers actually ask
Does Jev have SOC 2 certification?
Not published, as of the 2026-09-28 snapshot of TypeSafe's legal documents. There is no SOC 2 Type I or Type II report, no ISO 27001 certificate, and no certification claim in the legal index, DPA, or privacy policy. The audit-relevant substance that does exist is contractual: SCCs, a 72-hour breach-notice clause, annual security audits, a subprocessor list, and enterprise ZDR. Ask sales@typesafe.ai for current status — and verify trust.typesafe.ai yourself, because trust pages move.
Can my company use Jev if our vendor policy requires SOC 2?
It depends on whether your policy has a compensating-controls path. Most vendor-risk programs accept: contractual safeguards (the DPA gives you real ones), your own audit logging (the per-decision record), data minimization, and a documented fallback. If the policy instead demands a certification outright, hosted Jev fails that gate today — the self-hosted alternatives section is your realistic option, or wait for the roadmap answer from TypeSafe.
Is SOC 2 the same as ISO 27001?
No. SOC 2 is an AICPA attestation report on controls at a service organization over a period (Type II) or at a point in time (Type I); ISO 27001 is a certifiable international standard for an information-security management system. Buyers often accept either — but Jev publishes neither, so the distinction matters less here than the roadmap question.
What SOC 2 evidence does the Jev architecture make easy to collect?
Per-decision evidence: a typed answer with probabilities, a confidence value, and token usage — over criteria you defined. Add your own log (timestamp, state hash, question key, answer, confidence, policy threshold, outcome path) and you can reconstruct any production decision months later. Generation-free responses mean there is no free-text behavior to explain in an audit interview.
Does enterprise zero data retention (ZDR) replace SOC 2?
No — they answer different questions. ZDR bounds what the vendor keeps after processing; SOC 2 reports whether their controls operated over time. You want both, and ZDR is the one you can get in writing today via sales@typesafe.ai. Get it bound in the signed DPA, not just the landing page.
Do the open-source Jev alternatives have certifications?
Generally no — and one of them says so itself: laya.studio's FAQ discloses "no formal certification (such as ISO 27001) today". Self-hosting changes who is accountable (you), not whether a certificate exists. Teams self-host for data-plane control, not for compliance paperwork; the independent accuracy gap (best open ≈ 0.704 vs hosted 0.966 in our alternatives benchmark) is the trade you accept.
Will TypeSafe get certified? Should I wait?
We do not know — no roadmap is published in the documents we read, which is exactly why the checklist has you ask and log the answer. Our view: the controls in this page (minimize, log, gate, fallback) are worth shipping regardless of what the roadmap says, because they also carry GDPR Art. 22 and DPIA obligations that no certificate would discharge for you.