Skip to main content
For AI agents: a documentation index is available at https://docs.coverbase.com/llms.txt. This page is also available in markdown by appending .md to the URL.
Obligations Tracker keeps a living record of what your organization is responsible for when it engages a third party. Complementary user-entity controls (CUECs), contractual and legal terms, statement-of-work duties, and technical controls are extracted, assigned, and monitored so commitments don’t fall through the cracks between procurement, legal, and the control owners who have to satisfy them.

​
What it does

Obligation capture

Capture obligations from SOC 1 and SOC 2 Type 2 reports (CUECs) and from contract documents such as MSAs, SOWs and order forms (shared responsibilities) into structured, trackable records.

Ownership and assignment

Assign each obligation to an owner with a due date and status, so responsibility for every commitment is explicit and auditable.

CUEC management

Track complementary user-entity controls surfaced in vendor SOC 1 and SOC 2 reports, match them to your internal controls, and confirm your side of each shared-responsibility control is satisfied.

Lifecycle monitoring

Monitor due dates and satisfaction across vendors, ask a business unit to acknowledge an obligation, and, with the Risk module, raise an overdue or unacknowledged obligation as a risk signal.

​
How to integrate

Obligations API

List, retrieve, and filter obligations and their status programmatically.

Export API

Pull obligation commitments (who acknowledged what, and by when) into your GRC platform, contract management system, or compliance dashboards.

MCP Server

Query obligations conversationally. “Which CUECs are unsatisfied for our tier-1 vendors?” or “What obligations are due this quarter?”

Webhooks

Subscribe to Obligation.* events and react when obligations are created, updated (including reassignment), or deleted.

​
Common workflows

CUEC shared-responsibility coverage

When a vendor’s SOC 2 lists complementary user-entity controls, Obligations Tracker captures each one, assigns the responsible owner on your side, and tracks confirmation so shared-responsibility gaps are closed before they become audit findings.
Obligations extracted by Contract Guardian flow into the tracker, where SLAs, audit rights, and notification duties are assigned and monitored against the live engagement.
When an amendment or a new report arrives, extract obligations from it, compare them with the ones already on file for the vendor, and archive or reassign what changed so the obligation surface stays aligned with the current agreement.
Obligations are surfaced through the Obligations API and the MCP server, and their commitments through the Export API. Obligations extracted by Contract Guardian feed directly into the tracker. How to work them is in Obligations.