---
id: blog-soc2-type-ii
slug: soc2-type-ii
date: 2026-06-11
title: "LLM Gateway Is Now SOC 2 Type II Compliant"
summary: "LLM Gateway has successfully completed its SOC 2 Type II audit. Here's what that means, why it matters for teams routing LLM traffic through us, and how to request our report."
categories: ["Announcements"]
image:
  src: "/blog/soc2-type-ii.png"
  alt: "LLM Gateway SOC 2 Type II announcement"
  width: 1408
  height: 768
---

We're excited to announce that **LLM Gateway is now SOC 2 Type II compliant**. An independent auditor has examined our security controls — not just how they're designed, but how they operated in practice over an extended observation period — and verified that we meet the AICPA's Trust Services Criteria for security, availability, and confidentiality.

Your prompts, completions, and API keys flow through your gateway. That's a position of trust, and this report is third-party evidence that we treat it that way.

## What is SOC 2?

SOC 2 is a compliance framework developed by the [American Institute of Certified Public Accountants (AICPA)](https://www.aicpa-cima.com/topic/audit-assurance/audit-and-assurance-greater-than-soc-2) for assessing how service organizations protect customer data. An independent CPA firm audits the organization's controls against the Trust Services Criteria — covering areas like access control, change management, incident response, vendor management, and data protection.

There are two types of SOC 2 reports:

- **Type I** evaluates whether your security controls are suitably designed at a single point in time.
- **Type II** goes further: it verifies that those controls **actually operated effectively over a sustained observation period**, not just on the day of the audit.

Type II is the report enterprises ask for, because it demonstrates that security isn't a checkbox exercise — it's how the company runs day to day.

## What this means for you

If you're routing production LLM traffic through LLM Gateway — or evaluating us against your security requirements — this gives you:

- **Independent verification.** You don't have to take our word for how we handle your data. A third-party auditor has examined our controls in operation.
- **Faster security reviews.** Instead of a months-long questionnaire cycle, your security team can review our SOC 2 Type II report and our trust center directly.
- **A shorter path to procurement.** For many enterprises, a current SOC 2 Type II report is a hard requirement before any vendor touches production data. We now clear that bar.

This matters double for an LLM gateway: we sit between your application and every model provider you use. Centralizing that traffic is only a good idea if the layer in the middle holds itself to a higher standard than the integrations it replaces.

## Security has always been part of the product

SOC 2 Type II formalizes practices that have been core to LLM Gateway from the start, and it complements the security features our customers already rely on:

- **[Audit logs](/enterprise/audit-logs)** — tamper-evident trails of every config change, key rotation, and admin action, exportable for your own SOC 2 and HIPAA evidence.
- **[Guardrails](/enterprise/guardrails)** — prompt-injection detection, PII redaction, and content moderation at the gateway layer.
- **[SSO/SAML](/enterprise/sso-saml)** and role-based access control for your team.
- **Per-project routing overrides** — pin regulated workloads to specific regions and providers to keep your own compliance scope tight.
- **Open source** — our [core is AGPLv3 on GitHub](https://github.com/theopenco/llmgateway), so you can inspect exactly how your data is handled.

## Enforce SOC 2 across every provider you route to

Our own SOC 2 Type II report covers LLM Gateway — but your requests don't stop at the gateway. They fan out to model providers, and each provider has its own certifications and data policies.

That's what [provider compliance policies](https://docs.llmgateway.io/features/compliance) are for. On the Enterprise plan, you set the requirements once — SOC 2 Type II, ISO 27001, GDPR compliance, no training on prompts, no prompt logging — and the gateway blocks any request that would reach a provider that doesn't meet them, **before any data leaves the gateway**. Every requirement is fail-closed: a provider with an unknown attribute counts as non-compliant.

The dashboard makes the policy visible before you commit to it. The compliance settings page shows a live Provider Impact preview of exactly which providers your policy allows and blocks, and every provider picker in the dashboard is policy-aware — a green shield marks providers that meet your active requirements, a red shield lists exactly which ones they miss. You can also restrict routing to providers headquartered in specific countries, which pairs SOC 2 requirements with data-residency ones.

For a walkthrough of retention controls and residency-aware routing, see our [LLM compliance checklist](/blog/llm-compliance-checklist) and the guides on [data retention](/blog/llm-data-retention) and [EU routing](/blog/gdpr-compliant-llm-routing).

## How to get our SOC 2 report

Our trust center at [security.llmgateway.io](https://security.llmgateway.io/) is the home for our security posture: certifications, policies, and subprocessors. You can request access to the full SOC 2 Type II report there.

Have a custom security questionnaire or specific compliance requirements? [Contact us](/enterprise#contact) — our team is happy to work through them with you.

## Put a compliance boundary in front of your LLM traffic

If SOC 2 evidence is on your procurement checklist, you likely also need to control where prompts are allowed to go — not just audit it after the fact. That's an Enterprise capability, and it's usually a 30-minute conversation to scope:

- **[Talk to us about Enterprise](/enterprise#contact)** — compliance policies, custom data retention periods, audit logs, and SSO/SAML.
- **[Read the compliance policy docs](https://docs.llmgateway.io/features/compliance)** — how enforcement, the country filter, and custom-provider attestations work.
- **[Try LLM Gateway free](https://llmgateway.io/signup)** — the gateway itself, on any plan.
