SomabaseOpen workspace →Understand what leaves. See what the evidence proves.
Evaluate two separate questions: what data a model receives, and what proof supports a control.
Inspect the recipe and proofWhere data goes
Source access stays in your collection environment. A model provider may receive context according to your agent configuration. The ledger receives only approved, scoped artifacts and provenance.
Approval to upload is not control acceptance
Your local MCP host attests human approval before uploading an artifact. The portal records what was collected; review and certification remain separate activities.
Current coverage
All 51 SOC 2 recipes collect structured facts, not raw attachments. Collection deadlines are derived from source retention and audit constraints; they do not schedule automatic runs.
Evaluate one bounded workflow.
Start with fictional data and a clear definition of what must not be shared.