SOC 2 — Trust Services Criteria

SOC 2 — Trust Services Criteria — 92% of in-scope requirements covered.

61 requirements · 61 in scope (54 enforced · 2 designed · 5 advisory). The 92% is weighted over the in-scope base.

SOC 2: requirement → the KYE™ artefact that enforces it

Demo data

You learn: Which requirements KYE™ enforces at runtime and with which artefact. You can: Walk the requirements.

  1. 1 · enforced

    The entity maintains, monitors, and evaluates current processing capacity and use of system components…

    Audit events: kye.signal.drift.detected.v1, kye.compliance.attestation.v1, kye.spof.path_to_full.v1 · Constitution: 51 no spof, 34 reconciliation engine

  2. 2 · enforced

    The entity authorises, designs, develops or acquires, implements, operates, approves, maintains, and monitors…

    Audit events: kye.audit_retention_policy.v1, kye.compliance.attestation.v1, kye.spof.path_to_full.v1 · Workers: kye-d1-backup-worker, kye-dr-orchestrator · Constitution: 30 audit worm retention, 51…

  3. 3 · enforced

    The entity tests recovery plan procedures supporting system recovery to meet its objectives.

    Audit events: kye.compliance.attestation.v1, kye.assurance.audit_replay_report.v1, kye.signal.scenario_run.completed.v1 · Workers: kye-dr-orchestrator · Constitution: 13 resilience loop, 51 no spof

  4. 1 · enforced

    The entity identifies and maintains confidential information to meet the entity's objectives related to…

    Audit events: kye.evidence.decision_map.v1, kye.purpose.permission.v1 · Constitution: 31 data governance pack, 12 purpose permission

  5. 2 · enforced

    The entity disposes of confidential information to meet the entity's objectives related to confidentiality.

    Audit events: kye.audit_retention_policy.v1, kye.compliance.attestation.v1 · Constitution: 30 audit worm retention

  6. 3 · enforced

    Management establishes, with board oversight, structures, reporting lines, and authorities and…

    Audit events: kye.authority.grant.v1, kye.risk.authority_register.v1 · Constitution: 12 purpose permission

How this widget is built
Demonstrates
KYE™ Compliance Mapping Rail™
Components
  • Framework requirement (clause)
  • Coverage status
  • KYE™ enforcement artefact (event, decision-record field, Evidence Pack™ entry)
Flow
Clause → status → the KYE™ artefact that enforces it, enforced requirements first. Architecture diagram
Used on

Source: AICPA Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy (2017, points-of-focus revised 2022). Deep-mapping expanded 2026-05-29 (Wave-Ralph-B) from CC1-CC9 (33) to the full TSC surface — Common Criteria CC1-CC9 + Availability A1 + Confidentiality C1 + Processing Integrity PI1 + Privacy P1-P8. · License: AICPA — Trust Services Criteria are copyrighted; KYE™ registry paraphrases each criterion's intent and cites the criterion identifier for control-mapping purposes only.

By category

CategoryReqsEnforcedDesignedAdvisoryDeferredCoverage
A1 Availability33000100%
C1 Confidentiality22000100%
CC1 Control Environment5203055%
CC2 Communication & Information33000100%
CC3 Risk Assessment44000100%
CC4 Monitoring Activities22000100%
CC5 Control Activities33000100%
CC6 Logical & Physical Access Controls8611084%
CC7 System Operations55000100%
CC8 Change Management11000100%
CC9 Risk Mitigation22000100%
P1 Notice & Communication11000100%
P2 Choice & Consent11000100%
P3 Collection22000100%
P4 Use, Retention & Disposal33000100%
P5 Access22000100%
P6 Disclosure & Notification7511082%
P7 Quality11000100%
P8 Monitoring & Enforcement11000100%
PI1 Processing Integrity55000100%

Every requirement → the KYE™ artefact that enforces it

IDTitleStatusKYE™ enforcement
soc2.A1.1The entity maintains, monitors, and evaluates current processing capacity and use of system components (infrastructure, data, and software) to manage capacity demand and to enable the implementation of additional capacity to help meet its objectives.enforcedaudit_events: kye.signal.drift.detected.v1, kye.compliance.attestation.v1, kye.spof.path_to_full.v1
engines: internal, internal
registries: internal
constitution_refs: constitution/51-NO-SPOF.md, constitution/34-RECONCILIATION-ENGINE.md
soc2.A1.2The entity authorises, designs, develops or acquires, implements, operates, approves, maintains, and monitors environmental protections, software, data backup processes, and recovery infrastructure to meet its objectives.enforcedaudit_events: kye.audit_retention_policy.v1, kye.compliance.attestation.v1, kye.spof.path_to_full.v1
engines: internal, internal, internal
workers: kye-d1-backup-worker, kye-dr-orchestrator
constitution_refs: constitution/30-AUDIT-WORM-RETENTION.md, constitution/51-NO-SPOF.md
soc2.A1.3The entity tests recovery plan procedures supporting system recovery to meet its objectives.enforcedaudit_events: kye.compliance.attestation.v1, kye.assurance.audit_replay_report.v1, kye.signal.scenario_run.completed.v1
engines: internal, internal, internal
workers: kye-dr-orchestrator
constitution_refs: constitution/13-RESILIENCE-LOOP.md, constitution/51-NO-SPOF.md
soc2.C1.1The entity identifies and maintains confidential information to meet the entity's objectives related to confidentiality.enforcedaudit_events: kye.evidence.decision_map.v1, kye.purpose.permission.v1
engines: internal, internal
constitution_refs: constitution/31-DATA-GOVERNANCE-PACK.md, constitution/12-PURPOSE-PERMISSION.md
soc2.C1.2The entity disposes of confidential information to meet the entity's objectives related to confidentiality.enforcedaudit_events: kye.audit_retention_policy.v1, kye.compliance.attestation.v1
engines: internal
constitution_refs: constitution/30-AUDIT-WORM-RETENTION.md
soc2.CC1.1The entity demonstrates a commitment to integrity and ethical values.advisoryconstitution_refs: constitution/00-INDEX.md, constitution/12-PURPOSE-PERMISSION.md
soc2.CC1.2The board of directors demonstrates independence from management and exercises oversight of internal control.advisoryconstitution_refs: constitution/36-GOVERNEDUI.md
soc2.CC1.3Management establishes, with board oversight, structures, reporting lines, and authorities and responsibilities for objectives.enforcedaudit_events: kye.authority.grant.v1, kye.risk.authority_register.v1
engines: internal
constitution_refs: constitution/12-PURPOSE-PERMISSION.md
soc2.CC1.4The entity demonstrates a commitment to attract, develop, and retain competent individuals in alignment with objectives.advisoryconstitution_refs: constitution/10-PARTNER.md
soc2.CC1.5The entity holds individuals accountable for their internal control responsibilities in the pursuit of objectives.enforcedaudit_events: kye.authority.grant.v1, kye.evidence.decision_map.v1, kye.compliance.attestation.v1
engines: internal, internal
constitution_refs: constitution/13-RESILIENCE-LOOP.md
soc2.CC2.1The entity obtains or generates and uses relevant, quality information to support the functioning of internal control.enforced 1 unverified citationaudit_events: kye.evidence.decision_map.v1, kye.evidence.pack.v1, kye.audit.event.appended.v1 unverified citation
engines: internal, internal
constitution_refs: constitution/30-AUDIT-WORM-RETENTION.md
soc2.CC2.2The entity internally communicates information, including objectives and responsibilities for internal control, necessary to support the functioning of internal control.enforcedaudit_events: kye.comms.dispatched.v1
engines: internal
constitution_refs: constitution/38-COMMS-RAIL.md
soc2.CC2.3The entity communicates with external parties regarding matters affecting the functioning of internal control.enforcedaudit_events: kye.transparency.statement.v1, kye.compliance.attestation.v1
engines: internal
constitution_refs: constitution/38-COMMS-RAIL.md, constitution/21-DELEGATED-AUDITABILITY.md
soc2.CC3.1The entity specifies objectives with sufficient clarity to enable the identification and assessment of risks relating to objectives.enforcedaudit_events: kye.purpose.permission.v1, kye.risk.score.v1
engines: internal, internal
constitution_refs: constitution/12-PURPOSE-PERMISSION.md, constitution/13-RESILIENCE-LOOP.md
soc2.CC3.2The entity identifies risks to the achievement of its objectives across the entity and analyzes risks as a basis for determining how the risks should be managed.enforcedaudit_events: kye.risk.score.v1, kye.risk.authority_register.v1
engines: internal
constitution_refs: constitution/13-RESILIENCE-LOOP.md
soc2.CC3.3The entity considers the potential for fraud in assessing risks to the achievement of objectives.enforcedaudit_events: kye.signal.stress_test.high_risk_detected.v1, kye.risk.score.v1
engines: internal, internal
constitution_refs: constitution/13-RESILIENCE-LOOP.md
soc2.CC3.4The entity identifies and assesses changes that could significantly impact the system of internal control.enforcedaudit_events: kye.signal.drift.detected.v1, kye.signal.stable_drift.detected.v1, kye.risk.score.v1
engines: internal, internal
workers: kye-drift-detector
constitution_refs: constitution/13-RESILIENCE-LOOP.md
soc2.CC4.1The entity selects, develops, and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning.enforcedaudit_events: kye.assurance.audit_pilot.v1, kye.assurance.audit_replay_report.v1, kye.compliance.attestation.v1
engines: internal
agents: internal
workers: kye-audit-pilot-agent, kye-audit-replay-orchestrator
constitution_refs: constitution/21-DELEGATED-AUDITABILITY.md
soc2.CC4.2The entity evaluates and communicates internal control deficiencies in a timely manner to those parties responsible for taking corrective action, including senior management and the board, as appropriate.enforcedaudit_events: kye.signal.incident.opened.v1, kye.signal.incident.closed.v1, kye.signal.drift.detected.v1
engines: internal, internal
constitution_refs: constitution/13-RESILIENCE-LOOP.md, constitution/38-COMMS-RAIL.md
soc2.CC5.1The entity selects and develops control activities that contribute to the mitigation of risks to the achievement of objectives to acceptable levels.enforcedaudit_events: kye.evidence.decision_map.v1, kye.purpose.permission.v1
engines: internal, internal
workers: kye-pdp
constitution_refs: constitution/12-PURPOSE-PERMISSION.md, constitution/40-IMPLEMENTATION-CANONICAL.md
soc2.CC5.2The entity selects and develops general control activities over technology to support the achievement of objectives.enforced 1 unverified citationaudit_events: kye.authority.grant.v1, kye.evidence.decision_map.v1, kye.audit.event.appended.v1 unverified citation
engines: internal, internal
workers: kye-gateway, kye-pdp
constitution_refs: constitution/16-EDGE-RUNTIME.md, constitution/25-EDGE-GOVERNANCE.md
soc2.CC5.3The entity deploys control activities through policies that establish what is expected and in procedures that put policies into action.enforcedaudit_events: kye.signal.tool.compiled.v1
engines: internal
workers: kye-rules-gateway-worker
constitution_refs: constitution/29-PROFILES-LITE.md
soc2.CC6.1The entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events to meet the entity's objectives.enforcedaudit_events: kye.authority.grant.v1, kye.purpose.permission.v1, kye.evidence.decision_map.v1
engines: internal, internal, internal, internal
workers: kye-pdp, kye-gateway
constitution_refs: constitution/12-PURPOSE-PERMISSION.md, constitution/25-EDGE-GOVERNANCE.md
soc2.CC6.2Prior to issuing system credentials and granting system access, the entity registers and authorises new internal and external users whose access is administered by the entity. For those users whose access is administered by the entity, user system credentials are removed when user access is no longer authorised.enforcedaudit_events: kye.authority.grant.v1, kye.revocation.event.v1, kye.signal.revocation.cascaded.v1, kye.admin.tenant.revoked.v1
engines: internal, internal
workers: kye-pdp
constitution_refs: constitution/12-PURPOSE-PERMISSION.md
soc2.CC6.3The entity authorises, modifies, or removes access to data, software, functions, and other protected information assets based on roles, responsibilities, or the system design and changes, giving consideration to the concepts of least privilege and segregation of duties.enforcedaudit_events: kye.authority.grant.v1, kye.purpose.permission.v1, kye.risk.authority_register.v1
engines: internal, internal
workers: kye-pdp
constitution_refs: constitution/12-PURPOSE-PERMISSION.md
soc2.CC6.4The entity restricts physical access to facilities and protected information assets (for example, data centre facilities, back-up media storage, and other sensitive locations) to authorised personnel to meet the entity's objectives.advisoryconstitution_refs: constitution/16-EDGE-RUNTIME.md
soc2.CC6.5The entity discontinues logical and physical protections over physical assets only after the ability to read or recover data and software from those assets has been diminished and is no longer required to meet the entity's objectives.enforcedaudit_events: kye.compliance.attestation.v1
engines: internal
constitution_refs: constitution/30-AUDIT-WORM-RETENTION.md
soc2.CC6.6The entity implements logical access security measures to protect against threats from sources outside its system boundaries.enforcedaudit_events: kye.signal.decision.denied.v1, kye.evidence.decision_map.v1
engines: internal, internal
workers: kye-gateway
constitution_refs: constitution/25-EDGE-GOVERNANCE.md
soc2.CC6.7The entity restricts the transmission, movement, and removal of information to authorised internal and external users and processes, and protects it during transmission, movement, or removal to meet the entity's objectives.enforcedaudit_events: kye.evidence.decision_map.v1, kye.federation.cross_org_delegation.v1
engines: internal, internal
constitution_refs: constitution/31-DATA-GOVERNANCE-PACK.md
soc2.CC6.8The entity implements controls to prevent or detect and act upon the introduction of unauthorised or malicious software to meet the entity's objectives.designedaudit_events: kye.evidence.tool_call_pin.v1, kye.signal.tool.compiled.v1
constitution_refs: constitution/52-DELEGATED-AGENT-BINDING.md
soc2.CC7.1To meet its objectives, the entity uses detection and monitoring procedures to identify (1) changes to configurations that result in the introduction of new vulnerabilities, and (2) susceptibilities to newly discovered vulnerabilities.enforcedaudit_events: kye.signal.drift.detected.v1, kye.signal.stable_drift.detected.v1
engines: internal
workers: kye-drift-detector
constitution_refs: constitution/13-RESILIENCE-LOOP.md, constitution/34-RECONCILIATION-ENGINE.md
soc2.CC7.2The entity monitors system components and the operation of those components for anomalies that are indicative of malicious acts, natural disasters, and errors affecting the entity's ability to meet its objectives; anomalies are analysed to determine whether they represent security events.enforcedaudit_events: kye.signal.incident.opened.v1, kye.signal.stress_test.high_risk_detected.v1, kye.agency_drift.event.v1
engines: internal, internal
workers: kye-incident-detector, kye-drift-detector
constitution_refs: constitution/13-RESILIENCE-LOOP.md
soc2.CC7.3The entity evaluates security events to determine whether they could or have resulted in a failure of the entity to meet its objectives (security incidents) and, if so, takes actions to prevent or address such failures.enforcedaudit_events: kye.signal.incident.opened.v1, kye.signal.incident.closed.v1, kye.signal.revocation.cascaded.v1
engines: internal, internal
workers: kye-incident-detector, kye-authority-revocation-orchestrator
constitution_refs: constitution/13-RESILIENCE-LOOP.md
soc2.CC7.4The entity responds to identified security incidents by executing a defined incident response program to understand, contain, remediate, and communicate security incidents, as appropriate.enforcedaudit_events: kye.signal.incident.opened.v1, kye.signal.incident.closed.v1, kye.signal.evidence.sealed.v1
engines: internal, internal
workers: kye-incident-detector
constitution_refs: constitution/13-RESILIENCE-LOOP.md
soc2.CC7.5The entity identifies, develops, and implements activities to recover from identified security incidents.enforcedaudit_events: kye.signal.incident.closed.v1, kye.assurance.audit_replay_report.v1
engines: internal
workers: kye-audit-replay-orchestrator
constitution_refs: constitution/13-RESILIENCE-LOOP.md
soc2.CC8.1The entity authorises, designs, develops or acquires, configures, documents, tests, approves, and implements changes to infrastructure, data, software, and procedures to meet its objectives.enforcedaudit_events: kye.governedui.approval.v1, kye.evidence.pack.v1
engines: internal, internal
governedui_modules: kye.governedui.module.action_approval.v1, kye.governedui.module.approval_queue.v1
constitution_refs: constitution/36-GOVERNEDUI.md, constitution/40-IMPLEMENTATION-CANONICAL.md
soc2.CC9.1The entity identifies, selects, and develops risk mitigation activities for risks arising from potential business disruptions.enforcedaudit_events: kye.risk.score.v1, kye.spof.path_to_full.v1
constitution_refs: constitution/51-NO-SPOF.md, constitution/13-RESILIENCE-LOOP.md
registries: internal
engines: internal, internal
workers: kye-gateway
soc2.CC9.2The entity assesses and manages risks associated with vendors and business partners.enforcedaudit_events: kye.federation.cross_org_delegation.v1
engines: internal
constitution_refs: constitution/51-NO-SPOF.md
soc2.P1.1The entity provides notice to data subjects about its privacy practices to meet the entity's objectives related to privacy. The notice is updated and communicated to data subjects in a timely manner.enforcedaudit_events: kye.consent.acceptance.v1, kye.comms.dispatched.v1
engines: internal
constitution_refs: constitution/31-DATA-GOVERNANCE-PACK.md, constitution/38-COMMS-RAIL.md
soc2.P2.1The entity communicates choices available regarding the collection, use, retention, disclosure, and disposal of personal information to data subjects and the consequences, if any, of each choice.enforcedaudit_events: kye.consent.acceptance.v1, kye.purpose.permission.v1
engines: internal
constitution_refs: constitution/12-PURPOSE-PERMISSION.md, constitution/31-DATA-GOVERNANCE-PACK.md
soc2.P3.1Personal information is collected consistent with the entity's objectives related to privacy.enforcedaudit_events: kye.purpose.admissibility.v1, kye.evidence.decision_map.v1
engines: internal, internal
constitution_refs: constitution/12-PURPOSE-PERMISSION.md, constitution/31-DATA-GOVERNANCE-PACK.md
soc2.P3.2For information requiring explicit consent, the entity communicates the need for such consent as well as the consequences of a failure to provide consent for the request for personal information, and obtains the consent prior to the collection of the information to meet the entity's objectives related to privacy.enforcedaudit_events: kye.consent.acceptance.v1, kye.purpose.permission.v1
engines: internal
constitution_refs: constitution/12-PURPOSE-PERMISSION.md
soc2.P4.1The entity limits the use of personal information to the purposes identified in the entity's objectives related to privacy.enforcedaudit_events: kye.purpose.permission.v1, kye.evidence.decision_map.v1, kye.evidence.tool_call_pin.v1
engines: internal, internal
workers: kye-pdp
constitution_refs: constitution/12-PURPOSE-PERMISSION.md
soc2.P4.2The entity retains personal information consistent with the entity's objectives related to privacy.enforcedaudit_events: kye.audit_retention_policy.v1
engines: internal
constitution_refs: constitution/30-AUDIT-WORM-RETENTION.md
soc2.P4.3The entity securely disposes of personal information to meet the entity's objectives related to privacy.enforcedaudit_events: kye.audit_retention_policy.v1, kye.compliance.attestation.v1
engines: internal
constitution_refs: constitution/30-AUDIT-WORM-RETENTION.md
soc2.P5.1The entity grants identified and authenticated data subjects the ability to access their stored personal information for review and, upon request, provides physical or electronic copies of that information to data subjects to meet the entity's objectives related to privacy.enforcedaudit_events: kye.signal.dsar.requested.v1, kye.signal.dsar.fulfilled.v1, kye.dsar_evidence_pack.v1
engines: internal, internal
workers: kye-dsar-evidence-agent
constitution_refs: constitution/31-DATA-GOVERNANCE-PACK.md
soc2.P5.2The entity corrects, amends, or appends personal information based on information provided by data subjects and communicates such information to third parties, as committed or required, to meet the entity's objectives related to privacy.enforcedaudit_events: kye.signal.dsar.requested.v1, kye.signal.entity.updated.v1, kye.federation.cross_org_delegation.v1
engines: internal, internal
constitution_refs: constitution/31-DATA-GOVERNANCE-PACK.md
soc2.P6.1The entity discloses personal information to third parties with the explicit consent of data subjects, and such consent is obtained prior to disclosure to meet the entity's objectives related to privacy.enforcedaudit_events: kye.consent.acceptance.v1, kye.federation.cross_org_delegation.v1, kye.subprocessor.v1
engines: internal
constitution_refs: constitution/12-PURPOSE-PERMISSION.md, constitution/31-DATA-GOVERNANCE-PACK.md
soc2.P6.2The entity creates and retains a complete, accurate, and timely record of authorised disclosures of personal information to meet the entity's objectives related to privacy.enforcedaudit_events: kye.federation.cross_org_delegation.v1, kye.audit.event.v1, kye.evidence.tool_call_pin.v1
engines: internal
constitution_refs: constitution/30-AUDIT-WORM-RETENTION.md, constitution/21-DELEGATED-AUDITABILITY.md
soc2.P6.3The entity creates and retains a complete, accurate, and timely record of detected or reported unauthorised disclosures (including breaches) of personal information to meet the entity's objectives related to privacy.enforcedaudit_events: kye.signal.incident.opened.v1, kye.signal.incident.closed.v1, kye.audit.event.v1
engines: internal, internal
constitution_refs: constitution/13-RESILIENCE-LOOP.md, constitution/30-AUDIT-WORM-RETENTION.md
soc2.P6.4The entity obtains privacy commitments from vendors and other third parties who have access to personal information to meet the entity's objectives related to privacy.designedaudit_events: kye.subprocessor.v1, kye.compliance.attestation.v1
constitution_refs: constitution/21-DELEGATED-AUDITABILITY.md, constitution/52-DELEGATED-AGENT-BINDING.md
soc2.P6.5The entity obtains commitments from vendors and other third parties with access to personal information to notify the entity in the event of actual or suspected unauthorised disclosures of personal information.advisoryaudit_events: kye.subprocessor.v1, kye.signal.incident.opened.v1
constitution_refs: constitution/21-DELEGATED-AUDITABILITY.md
soc2.P6.6The entity provides notification of breaches and incidents to affected data subjects, regulators, and others to meet the entity's objectives related to privacy.enforcedaudit_events: kye.signal.incident.opened.v1, kye.comms.dispatched.v1
engines: internal, internal
workers: kye-comms-engine-worker
constitution_refs: constitution/38-COMMS-RAIL.md
soc2.P6.7The entity provides data subjects with an accounting of the personal information held and disclosure of the data subjects' personal information, upon the data subjects' request, to meet the entity's objectives related to privacy.enforcedaudit_events: kye.dsar_evidence_pack.v1, kye.federation.cross_org_delegation.v1
engines: internal
constitution_refs: constitution/31-DATA-GOVERNANCE-PACK.md
soc2.P7.1The entity collects and maintains accurate, up-to-date, complete, and relevant personal information to meet the entity's objectives related to privacy.enforcedaudit_events: kye.signal.entity.created.v1, kye.signal.entity.updated.v1, kye.reconciliation.verdict.v1
engines: internal, internal
constitution_refs: constitution/34-RECONCILIATION-ENGINE.md
soc2.P8.1The entity implements a process for receiving, addressing, resolving, and communicating the resolution of inquiries, complaints, and disputes from data subjects and others and periodically monitors compliance to meet the entity's objectives related to privacy.enforcedaudit_events: kye.signal.incident.opened.v1, kye.comms.dispatched.v1, kye.compliance.attestation.v1
engines: internal, internal
constitution_refs: constitution/13-RESILIENCE-LOOP.md, constitution/38-COMMS-RAIL.md
soc2.PI1.1The entity obtains or generates, uses, and communicates relevant, quality information regarding the objectives related to processing, including definitions of data processed and product and service specifications, to support the use of products and services.enforcedaudit_events: kye.evidence.decision_map.v1, kye.evidence.observed_action.v1, kye.compliance.attestation.v1
engines: internal, internal
constitution_refs: constitution/13-RESILIENCE-LOOP.md, constitution/43-MACHINE-READABLE-BY-DEFAULT.md
soc2.PI1.2The entity implements policies and procedures over system inputs, including controls over completeness and accuracy, to result in products, services, and reporting to meet the entity's objectives.enforcedaudit_events: kye.purpose.admissibility.v1, kye.evidence.decision_map.v1
engines: internal, internal, internal
workers: kye-pdp, kye-gateway
constitution_refs: constitution/12-PURPOSE-PERMISSION.md, constitution/25-EDGE-GOVERNANCE.md
soc2.PI1.3The entity implements policies and procedures over system processing to result in products, services, and reporting to meet the entity's objectives.enforcedaudit_events: kye.evidence.decision_map.v1, kye.reconciliation.verdict.v1
engines: internal, internal
reconcilers: registry-manifest-alive, openapi-worker-routes
constitution_refs: constitution/34-RECONCILIATION-ENGINE.md, constitution/40-IMPLEMENTATION-CANONICAL.md
soc2.PI1.4The entity implements policies and procedures to make available or deliver output completely, accurately, and timely in accordance with specifications to meet the entity's objectives.enforcedaudit_events: kye.evidence.pack.v1, kye.signal.evidence.sealed.v1, kye.comms.dispatched.v1
engines: internal, internal
workers: kye-comms-engine-worker
constitution_refs: constitution/35-STREAMING-LOGS.md, constitution/38-COMMS-RAIL.md
soc2.PI1.5The entity implements policies and procedures to store inputs, items in processing, and outputs completely, accurately, and timely in accordance with system specifications to meet the entity's objectives.enforcedaudit_events: kye.audit.event.v1, kye.audit_retention_policy.v1
engines: internal, internal
constitution_refs: constitution/30-AUDIT-WORM-RETENTION.md

Canonical KYE™ surfaces referenced on this page: KYE Protocol™.