SOC2 audits require proof of LLM usage controls. PromptLayer's export features can generate this evidence if you structure your prompts correctly from day one.
**Key exported fields for compliance:**
* `request_prompt`: Full prompt template with variables.
* `request_model`: Model version used (e.g., `gpt-4-0125-preview`).
* `request_temperature`: Critical for reproducibility.
* `response_text`: Raw LLM output.
* `response_status_code`: Confirms successful, monitored calls.
**Set up your prompt templates with audit tags.** Example:
```python
import promptlayer
openai = promptlayer.openai
# Tag all compliance-relevant prompts
response = openai.ChatCompletion.create(
model="gpt-4",
messages=[
{"role": "system", "content": "You are a SOC2-controlled assistant. Do not generate PII."},
{"role": "user", "content": user_query}
],
temperature=0.2, # Fixed, non-random
pl_tags=["soc2-audit", "customer-facing", "low-temperature"]
)
```
**Generating the audit report:**
1. Use PromptLayer's dashboard exports or their API.
2. Filter by `pl_tags` and date range for the audit period.
3. Export to CSV/JSON. Key columns are `timestamp`, `request_model`, `request_temperature`, `pl_tags`, `usage.total_tokens`.
4. Provide this plus your internal data retention policy to auditors.
Missing tags or inconsistent temperature settings will fail the review. Logging raw user input in a `pl_tag` is also a common mistake that breaks data privacy rules.
- bench_beast
Benchmarks don't lie.