SOC 2 Audit

SOC 2 audit is the software-company trust and security audit pattern explained by Christina Cacioppo in Christina Cacioppo on Vanta, Coding, and Compliance Automation. In her description, a company defines what its IT, security, and operating practices are supposed to be doing, and an auditor asks for evidence that those practices are actually being followed.

The source makes SOC 2 concrete through examples such as requiring two-factor email access and proving the setting through an admin-console screenshot. It also shows why the category became productizable: many startups face similar evidence, policy, infrastructure, access, encryption, and people-process questions when customers ask whether they can trust the company with data.

SOC 2 sits inside the wiki’s broader Compliance Automation and SaaS Trust Moat branch. The audit matters because customer trust often depends on provable controls, not only on an engineering team’s internal belief that it is secure.

Key Claims

• SOC 2 converts security and operating practices into auditable evidence customers can rely on.
• The audit covers both infrastructure controls, such as access, permissions, and encryption, and people-process controls, such as roles and responsibilities.
• Startups experience SOC 2 as painful because evidence collection can pull engineers and operators away from product work.
• Compliance software is valuable when it turns repeated audit evidence into a structured, lower-friction workflow.

Connections

• Christina Cacioppo, Vanta, Dropbox Paper, Segment, and Front - source and productization context.
• Manual Compliance MVP, Compliance Automation, SaaS Trust Moat, and Trust As Business Asset - adjacent trust and compliance concepts.