Does the tool look for gaps or deviations in controls called out in the SOC2 report, and does it consider these items in the AI justifications?

Gaps and deviations will be provided in justification if explicitly mentioned in the document.

For example, if the document contains the phrase: "We have no data centers located in the EMEA region" and the question in the assessment is: "Are data security protocols followed for data centers in EMEA?", then the response would be: "Not Applicable".

However, if the phrase mentioned above was not in the document, the response would not infer the absence to answer the question as "Not Applicable". It would leave the question unanswered.