ISO/IEC 27001
Information security management
Software inventory, access restrictions, configuration evidence and change records.
Human assessment: ISMS scope, risk treatment, policies, internal audits and independent certification.
Primary source ↗POLICY LIBRARY / RESEARCH PREVIEW
Checks with context.
A starting point for approved AI tooling. Each check needs a supported client version, an effective policy source, and evidence of what is actually in use.
These are documented control references and proposed mappings. Device adapters and framework assessments are not implemented in this preview.
AI configuration checks
Keep configured policy, runtime evidence and verified identity separate. Missing evidence remains unknown.
| Client | Documented controls | What still needs evidence |
|---|---|---|
| Claude Code Official reference ↗ | forceLoginMethod · forceLoginOrgUUID · allowedProvidersManaged login, organisation and provider restrictions on supported versions. | Provider and version affect enforcement. A lower-priority file does not prove effective policy. |
| Codex Official reference ↗ | allowed_login_methods · allowed_chatgpt_workspacesLocal managed requirements can restrict authentication and workspace selection. | Cloud-delivered policy ignores these authentication requirements. A setting alone does not establish data-processing terms. |
| Cursor Official reference ↗ | AllowedTeamId · organisation Privacy ModeA device-management policy can restrict team membership; Privacy Mode is a separate control. | An approved team does not establish approved retention exceptions or provider-key settings. |
| GitHub Copilot CLI Official reference ↗ | forceLoginOrgs · forceRemoteSettingsRefreshDevice-managed organisation restrictions and policy refresh on supported clients. | A personal GitHub identity can legitimately belong to a work organisation. Membership is not necessarily proof of the funding organisation. |
| Gemini CLI Official reference ↗ | security.auth.enforcedType · privacy.usageStatisticsEnabledConfigured authentication mode and telemetry preferences. | Authentication mode does not identify a work organisation. Telemetry preferences do not establish training or retention terms. |
COMPLIANCE EVIDENCE CATALOGUE
Map the evidence.
Name the gaps.
Alethrai’s proposed mappings identify useful evidence. Applicability, organisational controls, legal obligations and independent assessments remain separate.
SOC 2
Service controls and assurance
Evidence relevant to access, changes, monitoring and remediation.
Human assessment: System boundaries, applicable Trust Services Criteria and an independent examination.
Primary source ↗HIPAA
Security Rule applicability
Account restrictions and audit evidence that can support protection of health information.
Human assessment: Covered-entity or business-associate scope, risk analysis, safeguards and applicable business associate agreements.
Primary source ↗GDPR
Personal data protection
Minimised reports, access restrictions and retention controls can support Articles 25 and 32.
Human assessment: Lawful processing, notices, contracts, rights, transfers and any required impact assessment.
Primary source ↗PCI DSS
Payment environment security
Configuration, access and audit evidence for systems in the assessed environment.
Human assessment: Payment-data scope and applicable assessment. Hosted Stripe payments do not settle every merchant obligation.
Primary source ↗NIST CSF 2.0
Cybersecurity risk outcomes
Candidate topics include access policy, configuration, logs and software monitoring.
Human assessment: Organisational profiles, governance, risk priorities, incident response and recovery.
Primary source ↗CIS Controls
Prioritised security safeguards
AI-tool inventory and configuration checks can support asset, account, access and log controls.
Human assessment: Applicable safeguards, Implementation Group and coverage across the wider estate.
Primary source ↗ISO/IEC 42001
AI management systems
AI inventory, approved-use settings, owners and documented policy decisions.
Human assessment: AI governance, risk processes and lifecycle controls within an operating management system.
Primary source ↗EU AI Act
Role and use-case obligations
AI inventory, intended use and oversight records can inform an applicability assessment.
Human assessment: Provider or deployer role, intended purpose, risk classification and applicable obligations.
Primary source ↗A passed configuration check is not a framework verdict. Alethrai does not issue ISO certificates, SOC 2 reports, HIPAA certification, or a blanket GDPR compliance guarantee. These mappings are not endorsements from standards bodies or regulators.