SOC 2 evidence your auditor doesn't have to take on faith.
Run your SOC 2 program from one governed app: controls mapped to the Trust Services Criteria, evidence attested the moment it is captured, and review and testing kept independent by rule.
Compliance automation made SOC 2 faster. This example makes it provable, and it runs on your own hardware rather than a vendor's cloud.
The starting spec
This is what the App Configurator generates when you start from this example. Every row is editable before you publish, and every mechanism stays available inside the running app, so the app can keep changing after launch.
| Kind | Name | Definition | Notes | |
|---|---|---|---|---|
| 1 | Hub | control | criterion (e.g. CC6.1) · description · owner · frequency · systems | Mapped to Trust Services Criteria |
| 2 | Child | evidence | control 1 → n · period · source · captured_by · content_hash | Attested at capture |
| 3 | Child | test | control 1 → n · tester · procedure · result · exceptions | Independent testing |
| 4 | Index | evidence_unique | (control, period, source) unique | One evidence set per period |
| 5 | States | control_period.lifecycle | Scheduled → Evidence due → Collected → Reviewed → Tested → Accepted | Exception path to remediation |
| 6 | SoD | review_rule | reviewed_by ≠ captured_by; tested_by ≠ owner | Separation of duties |
| 7 | Report | readiness | Controls by criterion and state, with overdue evidence | Dashboard and kanban |
| 8 | Report | auditor_package | Accepted controls with evidence, tests and full history | Read-only auditor view |
Early accessOpen this spec in the App Configurator, change what doesn't fit, and download the application file.
The lifecycle
Each control runs through the same lifecycle every period. An auditor can see exactly who captured, reviewed and tested each control, and that no step was skipped.
| Transition | Who may make it | What must be true | Result |
|---|---|---|---|
| Evidence due → Collected | Control owner or collection agent | Evidence captured and hashed | Allowed · attested |
| Collected → Reviewed | Reviewer, never the collector | Evidence matches the control and period | Allowed · separation of duties checked |
| Reviewed → Tested | Tester independent of the owner | Test procedure run; result recorded | Allowed · attested |
| Tested → Accepted | Compliance lead | No open exceptions, or exceptions remediated | Allowed · attested |
| Collected → Accepted | No one | Transition not defined | Refused · refusal recorded |
Evidence you can trust, not just evidence you collected
Compliance automation tools made SOC 2 faster by pulling screenshots and settings from your cloud, identity and code platforms. Faster isn't the same as trustworthy. If an administrator can edit the evidence store, or an agent can write to it without attribution, the auditor is trusting the tool, not the evidence.
Typical compliance automation
- Integrations pull evidence on a schedule into the vendor's cloud.
- Independence between collector, reviewer and tester depends on how the tool is configured.
- Auditor access runs through the vendor's platform, under the vendor's controls.
- AI features act inside the vendor's trust boundary, not yours.
SOC 2 Control Room in DXMachine
- Every piece of evidence is hashed and attributed the moment it is captured.
- Collection, review and testing are separated by rule, not by habit.
- Your auditor is a bounded principal: read-only, time-boxed, every view recorded.
- Collection agents are named principals crossing a governed boundary.
PlannedAutomated evidence collection from cloud, identity and code platforms arrives with governed connectors in stage 3 of the roadmap. Until then, evidence is captured by owners and agents through the app, with the same attestation.
What you get that the usual tools don't give you
Evidence that proves itself
Every artifact carries its hash, its source and who captured it, on a record nobody can quietly edit.
A bounded seat for your auditor
Read-only, limited to the audit period, and every view attributed on your own record.
Your evidence stays in house
The program runs on your hardware or a dedicated instance. Your security posture never sits in a third-party cloud.
Start from this spec.
Open it in the App Configurator, rename it in your terms, change what doesn't fit, and review the result before anything runs. Your license includes full access to its source. Or bring it to the development advisory and we'll shape it with you.