SleekAI is a plugin you self-host. It does not operate a service that hosts customer data, so the SOC 2 framework does not directly apply to SleekAI as a vendor. The SOC 2 reports that matter to your audit are your hosting provider's (Kinsta, WP Engine, Pantheon, AWS) and your model provider's (OpenAI, Anthropic, Google).

OpenAI publishes a SOC 2 Type 2 covering the API platform. Anthropic publishes a SOC 2 Type 2 for their enterprise products. Google Cloud Vertex AI inherits Google Cloud's SOC 2. Azure OpenAI inherits Microsoft Azure's SOC 2. All four can be requested through standard customer-trust portals.

WordPress's native authentication and capability system logs login events through whatever WP-side audit-log plugin you run (WP Activity Log, Simple History, Sucuri). SleekAI admin pages are protected by capabilities, so they appear in those logs alongside other admin actions. No separate audit trail to maintain.

Yes. Per-bot configurations are stored as custom posts in WordPress, which means they carry post revisions, author IDs, and timestamps. Combine with an audit-log plugin for full change-tracking on system prompts, presets, and data source mappings. Useful for change-management evidence in CC8.1 controls.

WordPress traffic uses TLS as configured on your host. The outbound provider call from your server to OpenAI, Anthropic, Google, or OpenRouter uses TLS 1.2 or 1.3 enforced by the provider's API. SleekAI does not introduce a separate transport layer; all encryption-in-transit controls inherit from the host and provider.

Conversation logs are stored in the same WordPress database whose at-rest encryption posture is set by your host. Kinsta, WP Engine, Pantheon, and managed AWS/Azure setups encrypt at rest by default and that coverage extends to the SleekAI tables without separate configuration.

Yes. SleekAI exposes WP-CLI commands to export conversation logs filtered by date range, chatbot, or model. The output is CSV or JSON, ready to hand to a security analyst. For larger evidence requests, the same data is queryable directly against the WordPress database with read-only credentials.

Generally no. Because it runs on infrastructure already inside your boundary, it does not extend the boundary. The model provider is a sub-processor at the boundary's edge, the same as any cloud vendor your team contracted directly. Adding SleekAI is a configuration change, not a new vendor onboarding.