Make the intake specific
Supply the parties, document kind, jurisdiction, obligations, dates and reference material. Review imported content and retain its source identity before using it in a new matter.
Prepare SOC 2 checklist drafts your reviewers can finish
Start with Common Criteria and the Trust Services Criteria relevant to your service. Gixo drafts a structured checklist with evidence notes, open items, and exports for internal review before you rely on it.
Lex · real output
Read the matter facts and the resulting draft together.
This is a real Lex export for invented parties. Inspect the input and clauses as a worked example, with professional review kept separate from automated drafting and checks.
Mutual Non-Disclosure Agreement (worked example)
A mutual non-disclosure agreement of 14 numbered clauses between two invented parties: definitions, what counts as confidential information, exclusions, the receiving party's obligations, permitted disclosures, return of materials, remedies, term, survival, governing law, notices and signature blocks. Its first page says it is a worked example, not a legal document.
Inspect the source brief or data
Draft a Mutual Non-Disclosure Agreement between Larkfield Analytics Ltd (Party A) and Fenwick & Dale Stores Ltd (Party B). Governing law: England and Wales. Effective date: 2027-01-15. Term: Two years from the effective date. Confidentiality: Three years after disclosure. A mutual agreement: each party may disclose and receive confidential information. State on the first page that the parties, people and addresses in this agreement are invented and that it is a worked example, not a legal document. The notice email address of Larkfield Analytics Ltd is notices@larkfield-analytics.example and of Fenwick & Dale Stores Ltd is notices@fenwick-dale.example (both invented).
Read the sample review notes
Read mechanically against the intake, not by a lawyer: all 12 facts the intake gave are in the draft, nothing is left as a placeholder, and it states no term the intake did not give.
Inspect clauses and changes
Use the legal workspace's permitted structural tools, Draft Checks and review paths. Compare proposed changes with the saved draft and original material; unsupported Word edits must be handled explicitly.
Approve the exact version
Have qualified counsel review enforceability, local requirements and the actual commercial intent. Check the current approval state and the downloaded document after a change.
Structured clause proposals and permitted changes
Select the target clause and give Ask Lex a bounded instruction. Missing facts remain visible for review. Inspect the before-and-after proposal, required clause checks and any explicit outside-matrix or mandatory-clause override before versioned application. Use the legal workspace's structural allowlist rather than assuming every general content-editor block is available.
Playbooks, source evidence and obligations
Inspect immutable playbook versions, anchored findings, provenance and precedent variants before staging a change. Matters retain original sources, quotation findings and source-version comparisons. Review extracted obligations for timing, ownership and source revision; negotiation turns and agreement-pack review cells have their own decisions and current-version requirements.
Original Word, redlines and the delivery receipt
Original-format Word export, tracked changes against an original and saved-version redlines are separate paths. Unsupported edits must be surfaced rather than silently claimed as preserved. Inspect the layout, validator notes and downloaded file, then retain its delivery receipt. Counsel's review applies to the actual matter and version.
AI contract review, key terms and review of every document
Every contract in Lex, drafted or imported, gets an AI contract review: each clause the document type expects marked present, weak or absent; up to 25 risks with a level, the party each falls on, why it matters and replacement wording; and provisions that cannot both be followed. Every quotation is checked against the contract text, findings are decided before approval, and there is no single risk score. The same review reads the key terms and obligations with the words they quote and proposes them into the Agreement Pack. Review every document puts up to 25 documents of an Agreement Pack, or up to 200 in a matter, into one table with your own questions as columns and an Excel export. Approvers can be named in order, and signing supports up to 10 signers with an optional signing order and automatic reminders; it is a simple electronic signature, not a qualified one. A qualified reviewer still decides what the contract says.
Lex does not provide legal advice or certify compliance. The public specimen is not a universally reusable legal template. Word fidelity depends on the supported original-document and saved-version path; unrestricted Power Edit and image insertion are not legal editing features.
A SOC 2 checklist maps controls, evidence, and open items across the five Trust Services Criteria — Security, Availability, Processing Integrity, Confidentiality, and Privacy. Gixo drafts a reviewable checklist with criteria, evidence notes, and placeholders designed to surface missing facts. Reviewers verify every item before relying on it.
What is a SOC 2 compliance checklist?
The job is not to ask AI for a legal answer. The job is to prepare a draft or artifact that a qualified reviewer can actually work with.
Trust Services Criteria structure
Name the Trust Services Criteria your service is scoped for in the brief, and the draft follows that framing — from the model's understanding of SOC 2, not a built-in criteria catalog.
Evidence notes per section
Each section can carry evidence expectations and support notes so reviewers know what still needs to be checked or attached.
Open items stay visible
If a fact, screenshot, policy reference, or implementation detail is missing, keep that gap in the checklist instead of hiding it.
Type I and Type II notes
Use the draft to note point-in-time or observation-window context, without turning the page into a scheduling or monitoring system.
Custom control additions
Add company-specific controls, compensating controls, or reviewer notes when the standard structure needs to be adapted to your environment.
Review packet export
Export the checklist as PDF, DOCX, HTML, and TXT so the same structure can move into counsel, audit, or management review.
What are the five SOC 2 Trust Services Criteria?
SOC 2 is organized around five Trust Services Criteria. Security (the Common Criteria) is always in scope; Availability, Processing Integrity, Confidentiality, and Privacy are added when they apply to your service. Name the criteria that apply in your document brief and the draft follows that framing — this is prompt-driven, not a built-in Trust Services Criteria catalog with enforced coverage per criterion.
What are the steps to SOC 2 compliance?
SOC 2 preparation moves through four phases — scope and criteria, gap review, remediation and evidence, then audit and maintenance. The table below shows what each phase covers and what Gixo drafts. Gixo drafts and structures the document; it does not collect evidence from your tools for you.
| SOC 2 phase | What the checklist covers | Trust Services Criteria in play | What Gixo drafts |
|---|---|---|---|
| 1. Scope & criteria | Pick report type (Type I vs Type II), systems, teams in scope | Security (Common Criteria) always in scope; add Availability, Processing Integrity, Confidentiality, Privacy as they apply | Checklist skeleton following the criteria you name in your brief |
| 2. Gap review | Compare current controls to each criterion; log gaps | All selected criteria | Section headings with evidence prompts and open-item placeholders |
| 3. Remediation & evidence | Assign owners, implement controls, gather evidence artifacts | All selected criteria | Evidence notes per section; custom/compensating controls you add |
| 4. Audit & maintenance | Auditor collects evidence over the observation window, then attests | All selected criteria | Reviewer-ready export (PDF, DOCX, HTML, and TXT) for counsel, audit, or management |
Type I is a point-in-time review; Type II observes controls over a window (commonly 3–12 months). The formal audit itself typically runs 2–5 weeks. Gixo drafts and structures the document — the observation and evidence-gathering work stays with your team and your auditor.
How do you build a SOC 2 checklist?
1
Choose the SOC 2 scope
Name the Trust Services Criteria categories that matter for your service in the brief, and upload any prior files you want the draft to follow.
2
Draft the checklist with evidence notes
Generate a first pass with section headings, evidence prompts, and status placeholders your reviewers can refine.
3
Mark open items and reviewer notes
Capture missing facts, team follow-up, or observation-window notes directly in the draft instead of assuming the platform already knows them.
4
Export for internal or auditor-facing review
Export when the checklist is ready for legal, audit, or management review. The deliverable is the document, not a monitoring dashboard.
Does an AI generator make you SOC 2 compliant?
No. Gixo helps prepare regulated work. It does not provide legal advice, certify compliance, or replace professional review. Evaluate checklist drafting, operational evidence work, and the independent audit as separate responsibilities.
What Gixo prepares
A checklist draft with the requested Trust Services Criteria framing, evidence notes, open items, and reviewer-ready export.
What remains operational
Control implementation, evidence collection, observation-period operation, monitoring, remediation, and sign-off remain outside Gixo.
What establishes assurance
Your accountable team and independent auditor verify the scope, evidence, control operation, and report. A generated checklist cannot certify readiness.
SOC 2 checklist drafting vs. compliance automation platforms
They start from opposite ends. Gixo starts from your brief or a prior file and produces the checklist document: Trust Services Criteria structure, evidence notes, custom and compensating controls you add, and open items, exported as PDF, DOCX, HTML, and TXT. A compliance automation platform starts from operational records, runs always-on monitoring, and keeps evidence inside the platform, so the checklist itself is usually a byproduct of platform views. Neither performs the audit. Category descriptions are as of mid-2026, not vendor quotes; confirm current capabilities with each product.
| Capability | Gixo | Compliance automation platforms |
|---|---|---|
| Starting point | Checklist draft from brief or prior file | Operational compliance records |
| Trust Services Criteria structure in a document | Yes | Ask to see it in an export |
| Evidence notes in the artifact | Yes | Ask where evidence notes live |
| Always-on platform monitoring | Not included | Yes |
| Custom and compensating control additions | Yes | Varies |
| Reviewer-ready export | PDF, DOCX, HTML, and TXT | Reports and exports |
The other columns describe what each kind of tool is generally for, not a test of a named product, and products differ. Ask each vendor for a checklist export, where evidence notes live, and what reviewers can add. Run the same brief and reference files through anything on your shortlist, then compare the draft, the review trail and the export.
Frequently asked questions
What is a SOC 2 compliance checklist?
A SOC 2 compliance checklist maps the controls, evidence, and open items you need before an AICPA audit across the five Trust Services Criteria — Security, Availability, Processing Integrity, Confidentiality, and Privacy. Gixo drafts that checklist as a reviewable document with structured criteria, evidence notes, and placeholders where facts are still missing.
How long does SOC 2 compliance take?
It depends on report type. A Type I report is a point-in-time review, while a Type II report observes controls over a window that commonly runs 3–12 months. The formal audit itself typically runs 2–5 weeks. Gixo drafts and structures the checklist document; the observation window and evidence gathering stay with your team and auditor.
Does Gixo structure SOC 2 drafts around the Trust Services Criteria?
Name the Trust Services Criteria categories that fit your scope in the document brief, and the draft follows that framing. This is prompt-driven — Gixo does not (yet) enforce coverage against a built-in Trust Services Criteria catalog the way it does for GDPR Article 30 records of processing, GDPR Article 30(2) processor records of processing, GDPR Article 35 data protection impact assessment, GDPR Articles 33 and 34 breach procedure and register, CCPA and CPRA notice at collection, HIPAA Notice of Privacy Practices, HIPAA Security Rule risk analysis, so review the resulting draft against your own auditor, counsel, or internal reviewer expectations.
Is this a replacement for a compliance automation platform?
No. Those products are operations and monitoring platforms: they collect evidence from your systems and watch controls over time. Gixo prepares the document your reviewers work through — a SOC 2 checklist draft with Trust Services Criteria structure, evidence notes, custom controls, and open items, exported as PDF, DOCX, HTML, and TXT. Category descriptions are as of mid-2026; confirm current capabilities with each product.
Can I use the checklist for Type I and Type II preparation?
Yes, as a draft artifact. You can capture point-in-time or observation-window notes in the checklist, then review them before relying on the output.
Can I add custom controls?
Yes. Add custom controls, compensating controls, or company-specific reviewer notes so the draft matches your actual environment.
Does Gixo certify readiness?
Gixo helps prepare regulated work. It does not provide legal advice, certify compliance, or replace professional review.
What export formats are available?
Export as PDF, DOCX, HTML, and TXT.
Gixo Legal & Compliance
Compliance Checklists
ISO 27001 Drafts
Evidence Matrix
SOX Compliance Generator
Compliance Workspace
Pricing
Updated
More from Gixo