soc2-rails
SOC 2 for Rails
SOC 2 is the de-facto enterprise procurement requirement. Most US-based B2B SaaS deals over ~$25k/year now demand a SOC 2 Type II report. Getting compliant is 60% policies + procedures (Drata/Vanta-shaped), 40% engineering. This skill covers the engineering 40%.
The opinion
Adopt a compliance vendor (Drata, Vanta, Secureframe) from day one — DIY SOC 2 is a quagmire. The vendor handles ~80% of evidence collection via integrations. Engineering's job: audit logs that survive deletion, automated access reviews via SCIM, change-management via PR review + CI, vendor inventory, MFA on every privileged surface. Aim for SOC 2 Type II from the start — Type I is a snapshot; Type II covers a period (typically 6-12 months) and is what customers want to see.
Trust Services Criteria
SOC 2 is built on the 5 TSCs. You pick which apply:
| TSC | Required? | What it covers |
|---|---|---|
| Security | Always | Access controls, change management, monitoring |
| Availability | If you offer uptime SLA | Capacity, backup, BCDR |
| Processing Integrity | If you process customer data accurately matters | Data quality, processing correctness |
| Confidentiality | If you handle confidential customer data | Encryption, NDA, deletion |
| Privacy | If you handle personal data (often paired with GDPR/CCPA) | Consent, retention, breach notification |