SOC 2 and ISO 27001 are useful AI vendor security signals, but they do not prove every model workflow is safe. Here is what small businesses should ask before connecting sensitive data or agent permissions.