SOC 2 compliance tells a customer that Evolphin’s infrastructure is secure, available and handled privately. It says nothing about whether the media inside it is being used, shared or trained on within its rights. In 2026, that second question is the one keeping media and legal teams up at night, and it’s a different problem than the one SOC 2 was built to solve.
We earned our SOC 2 report in 2024 and recertify annually, and I still think it matters. But treating it as the finish line for media governance was always a stretch, and the last two years have made that obvious.
Why the bar moved
Two things changed. AI made content easier to find, repurpose and feed into other systems, so a rights problem that used to surface slowly now surfaces instantly, and often publicly. And the legal environment caught up: in May 2026, five publishers and author Scott Turow sued Meta in the Southern District of New York, alleging the company trained its Llama models on more than 267 terabytes of copyrighted books and journal articles pulled from pirate sites. The case is about book publishing, not media asset management, and the allegations haven’t been proven, but it’s a clear signal: training-data provenance is now litigated, not theoretical.
As AI changes digital asset management, governance must keep pace with how quickly content can be found and reused.
A dedicated standard for this gap is also taking shape. ISO/IEC 42001, first published in 2023, is the first certifiable standard for how an organization governs its use of AI, and it became a formal European standard in March 2026. It asks a different question than SOC 2, and its existence tells you general infosec compliance is no longer enough on its own. Verified Market Research prices the shift too, putting the global digital rights management market at $5.2 billion in 2024, projecting $14.16 billion by 2032.
What SOC 2 actually covers, and what it doesn’t
SOC 2 reports against five Trust Services Criteria, and we’re proud to meet them. But it’s worth being precise about where that coverage stops, for anyone using a SOC 2 badge as a proxy for “our content is safe.”
The access and audit layer: real, and live today
.avif)
The part of this that’s solvable right now is who can see, share and act on a piece of content, with a record of it. That’s what we built the Collaboration module around, launched October 1. Domain whitelisting onboards an entire partner organization at once. Expiration rules close access automatically instead of relying on someone remembering to. Delegated management lets a trusted collaborator onboard their own team under permissions you still control, with a full audit trail behind it. These controls are the foundation of secure collaboration with internal and external stakeholders.
Underneath that, Index in Place keeps our index honest against your actual storage, and scheduled reconciliation reports flag missing originals and access problems as they happen, rather than waiting for a yearly scan to notice. That’s the layer that answers “who can touch this, and can you prove it.” It’s necessary. It isn’t the whole answer.
The next layer: rights, not just access
Knowing who can see an asset isn’t the same as knowing whether anyone is allowed to use it the way they’re about to: a talent release that expired last month, a stock license scoped to one campaign, a clip under embargo. Today, catching that still depends on someone remembering to check, which is exactly the kind of work that gets missed under a deadline.
Checking whether your library is ready for AI also means checking whether licence terms, releases and restrictions are recorded alongside the assets.
This is where we’re taking Autonomous MAM over the next year: having the system flag rights and expiry conditions on an asset itself, so a license lapsing surfaces on its own instead of being discovered the hard way. It’s in development, not shipped, and I’d rather say that plainly. The principle doesn’t change from anything else we’ve built: the AI takes the work, not the job. Flagging an expired license is work nobody should remember by hand. Deciding what a contract permits stays a human, legal judgment call.
What to ask any vendor about this, not just us
Do you have SOC 2, or an equivalent? Table stakes, worth confirming directly rather than taking a badge at face value.
Does the system track usage rights on individual assets, or only who can see them? Access control and rights tracking are different problems. Make the vendor say which they’ve solved.
Can you produce an audit trail for a specific asset, on demand? Who viewed, shared or exported it, and when. If a rights holder asks, you need an answer in minutes.
Is the index reconciled against real storage, or just scanned once at setup? A search result pointing at a file that’s moved or gone is worse than no result.
What happens to AI-generated derivatives if the source license lapses? Most vendors haven’t thought about this. Ask anyway.
Which of these is live today, and which is roadmap? Ask for a date. A vendor who won’t give you one is telling you something.
Where Evolphin X stands on this today
In Evolphin X Media Asset Management, Core owns security and access control as a foundation. The Collaboration module gives you domain-based access, expiration and an audited trail today. Index in Place and our reconciliation reports keep the index honest against real storage. Rights and expiry enforcement on individual assets is next, in development, and we’ll say so plainly when it ships, not before.
Common questions
Is Evolphin X still SOC 2 compliant? Yes, recertified annually against the AICPA’s Trust Services Criteria since 2024.
Does SOC 2 cover our content’s usage rights? No. It covers infrastructure security, availability, integrity, confidentiality and privacy, not licensing or who’s allowed to use a specific asset.
Can Evolphin X catch an expired license today? Not yet. Live today: access control, share expiration and storage reconciliation. Flagging rights on the content itself is next year’s work.
How does ISO 42001 differ from SOC 2? SOC 2 assesses infrastructure controls; ISO 42001 assesses how an organization governs its use of AI. Different questions, neither replaces the other.
Tell us what you’re actually worried about
If your legal team has a specific scenario they lose sleep over, an expired release, an untracked licence, tell us. We’ll say plainly what we handle today and what’s still ahead.
Email me at brian@evolphin.com.
.avif)