Principal and scope
The server resolves the workspace and scope authorized for the authenticated principal. A browser-supplied tenant identifier grants no access.
Security & compliance
Enterprise trust starts with evidence.
Evaluate the security boundary around your Amazon Bedrock AgentCore application. Review the controls in Kam State, the AWS configuration that needs verification, and our path toward SOC 2.
SOC 2 roadmap
Planned · no report available
Our goal is an independent SOC 2 Type II report for a defined Kam service boundary.
Kam AI has not completed a SOC 2 examination. An auditor, examination period, and completion date have not been announced.
Status reviewed
Explore the roadmap →On this page
Security foundation
Review what the product enforces.
Kam records application-supplied outcomes and exact input references. Your application controls model calls, tool permissions, and external actions.
Source and local evidence · 2026-10-14
Stale authority
Serving and conditional-commit paths recheck lifecycle and authority. Revoked or expired authority and stale fences block serving or commit; retained bytes do not renew permission.
Missing required evidence
Exact reads preserve unavailable, expired, and unresolved positions. Missing required evidence blocks a current State selection or complete Context package; no latest substitution.
Retention and historical access
An earlier revision remains inspectable while retained and authorized. Logical expiry stops access before background TTL cleanup; a historical read grants no permission to act.
These are source and offline test boundaries. Deployed IAM, revocation, tenant isolation, erasure, and restore journeys still require cloud qualification.
Review security contracts and test boundaries →AWS control requirements
Infrastructure is one part of the review.
AWS secures its cloud infrastructure. Kam must configure and operate its service controls; customers govern their applications, identities, and data.
AWS SOC reports cover AWS services within their stated scope. They do not provide a SOC 2 report for Kam AI.
The controls below are requirements for a qualified deployment, not a claim that these AWS services or configurations are enabled today.
Identity & tenant boundaries
Least-privilege IAM roles, scoped authorization, and administrative MFA.
Evidence to verify
Verify Cognito identity, role trust and permission policies, cross-tenant denial, revocation, access reviews, and joiner/leaver records.
Encryption & secrets
TLS in transit, encryption at rest, and restricted key and secret access.
Evidence to verify
Verify DynamoDB and any in-scope S3 encryption settings, KMS key policies, secret storage and rotation, and redaction from logs and model inputs.
Network & storage access
Explicit ingress, egress, resource policies, and private access where required.
Evidence to verify
Review public endpoints and bucket exposure, applicable VPC endpoints, resource policies, and environment separation. Record each justified exception.
Monitoring & audit evidence
Trace administrative changes, access decisions, and security findings.
Evidence to verify
Verify CloudTrail coverage, CloudWatch alerts, applicable AWS Config rules and threat detection, protected log retention, and documented response ownership.
Retention & recovery
Document deletion, backup retention, recovery targets, and restore tests.
Evidence to verify
Qualify DynamoDB point-in-time recovery, restore fences, and deletion across primary data, replicas, logs, and backups. Record RPO/RTO test results and exceptions.
Change & incident management
Review releases, remediate vulnerabilities, and rehearse incident response.
Evidence to verify
Retain change approvals, dependency scans, scoped security testing, remediation records, incident exercises, vendor reviews, and staff security training.
Path to SOC 2
From control design to independent assurance.
Security is the baseline category. Availability, confidentiality, processing integrity, and privacy will be scoped with customers and the independent auditor.
- Planned
Define the boundary
Inventory the service, data flows, vendors, and risks. Assign control owners and agree the examination scope.
- Planned
Close readiness gaps
Document policies and qualify AWS access, encryption, isolation, monitoring, recovery, and incident procedures.
- Planned
Operate & collect evidence
Run the controls over an agreed observation period. Retain reviews, logs, exercises, changes, and remediation evidence.
- Planned
Complete independent examination
Engage an independent CPA firm, address findings, and share the resulting report subject to its distribution terms.
This is a planned program, not an audit in progress or a guaranteed completion date. Technical tests alone do not establish SOC 2 assurance.
What do Type I and Type II mean?
Type I examines control design at a specified date. Type II also examines operating effectiveness over a specified period. A Type I report may be a readiness milestone; it is not a prerequisite to Type II.
Enterprise review
Bring your security requirements.
Discuss your deployment boundary, data classification, retention, and procurement requirements before an evaluation.
What to include in your request
- Architecture, data flows, tenant access, and the evidence available for the reviewed release.
- Required AWS regions, residency, subprocessors, data handling, and contract or DPA requirements.
- Audit deadlines, penetration-test expectations, recovery targets, SSO needs, and incident notification terms.
Evidence availability and contractual commitments must be agreed for the evaluation. No SOC 2 report, production SLA, SSO capability, or residency commitment is implied.
Does SOC 2 certify an AI agent’s decisions?
No. SOC 2 examines controls within a defined system boundary. Kam’s retained history can support investigation, but it does not prove real-world truth, model safety, or permission to take an action.