How to use the Vericto audit trail as evidence in a SOC 2 audit

Updated October 5, 2026: covers the PDF compliance report, the Enterprise monthly report and the full control mapping.

The evidence problem in SOC 2 Type II

A SOC 2 Type II audit does not only check whether you have controls: it checks whether they worked consistently over a period, usually 6 to 12 months. You need evidence of each control operating throughout that time, not a written policy.

For data access, the auditor usually asks for something concrete: "show me which operations reached the production database during the period, which ones were blocked and which rules were in force."

Without a layer that records every decision, answering that means rebuilding the evidence from database, application and deployment logs: manual, error-prone work that rarely covers the whole period.

What the audit trail records

Every query Vericto evaluates at runtime, through the proxy or the API, creates an event in the audit trail with:

• Date and time in UTC
• The query text, encrypted at rest with AES-256-GCM (or sanitized, depending on the telemetry mode)
• Its hash, to search and correlate without exposing the content
• The decision: ALLOWED, BLOCKED, FLAGGED or MONITORED
• The rule that fired, with its code and severity
• The AST node that triggered it, for example DeleteStmt > WhereClause = NULL
• The database and the source channel (tcp for the proxy, http for the API)
• The latency of the evaluation

This is what an event looks like in the JSON export:

{
  "event_id": "f47ac10b-58cc-4372-a567-0e02b2c3d479",
  "timestamp": "2026-09-15T02:14:33.847Z",
  "database": "prod-db",
  "status": "BLOCKED",
  "rule_code": "VERICTO-001",
  "severity": "critical",
  "ast_node_path": "DeleteStmt > WhereClause = NULL",
  "query_hash": "e3b0c44298fc1c149afbf4c8996fb924...",
  "latency_ms": 1.3,
  "source": "tcp"
}

Why the auditor can trust the export

A log is evidence only if no one could have altered it afterwards. Vericto ensures that in two ways:

• No editing or deletion. The database rejects any change to or deletion of audit trail events, wherever it comes from; they only leave it when retention expires.
• Ed25519-signed exports. Every exported file, and its PDF report, is signed as a whole. The auditor verifies it offline with Vericto's public key: any change, even a single space, invalidates the signature.

The PDF report: what the auditor reads

The CSV or JSON is the raw evidence. Next to every export, Vericto generates a PDF compliance report for the same period, signed just like the data:

• Period summary: queries evaluated, blocked and flagged, by severity and with their daily trend
• Most triggered rules during the period
• Control mapping for SOC 2 and ISO 27001, with each control's evidence and what weakens it
• The configuration the proxy enforced at the start and end of the period, and the changes in between
• An appendix with the data file's hash and signature, tying both documents together

You can see what it looks like in the sample report, generated with fictional data.

Which controls it provides evidence for

The dashboard's Controls tab, and section 3 of the PDF, relate the period's activity to these criteria:

For ISO/IEC 27001:2022, the same mapping covers Annex A controls A.5.18, A.8.2, A.8.3, A.8.15, A.8.16 and A.8.32.

How to hand the evidence to the auditor

• Team: on-demand export. From Audit Trail, export the period as CSV or JSON. Under Reports you download the file, the PDF report and each one's signature. Files are available for 7 days: keep them in your evidence repository.
• Enterprise: a report every month, without asking. On the 1st of each month Vericto generates the signed report for the previous month and keeps it 13 months, or what your contract sets. When the audit comes, the period's twelve reports are already there.
• Changes in CI: signed receipts. vericto check --receipt leaves a signed receipt for each migration check, which the auditor verifies offline with vericto verify-receipt. It is direct evidence for change management (CC8.1).

# En CI: valida las migraciones y deja un recibo firmado
vericto check --changed --receipt vericto-receipt.json

# El auditor lo verifica sin conexión, sin cuenta ni credenciales
vericto verify-receipt vericto-receipt.json --show

Retention and the audit period

A Type II audit period is usually 6 to 12 months. What each plan keeps:

• Free: 7 days of history, to evaluate Vericto
• Builder: 30 days of history
• Team: 90 days of history, with on-demand exports and PDF report
• Enterprise: unlimited history, or what your contract sets, and monthly reports kept 13 months

On Team, export every month and keep the files with their signature: they stay verifiable even after the events leave retention. On Enterprise, the monthly reports do that work for you.

Beyond SOC 2: ISO 27001 and GDPR

• ISO/IEC 27001:2022: the record of every decision is evidence for A.8.15 (logging) and A.8.16 (monitoring), and the rules for A.8.3 (information access restriction).
• GDPR: Article 32 (security of processing) relies on evidence of controls over access to personal data.

The advantage of deterministic AST analysis is that the claim can be verified: "every DELETE without WHERE is blocked" can be reproduced in front of the auditor, without relying on a probability.