The evidence problem in SOC2 Type II
A SOC2 Type II audit is not just a questionnaire. Auditors need evidence that controls operated during the audit period, typically 6 or 12 months.
The question auditors always ask: "How do you demonstrate the control operated during the audit period?" With Vericto, the answer is: "With the audit trail export signed by this endpoint."
Without a proxy layer, evidence of database access is scattered across application logs, DB logs, and monitoring tools. Correlating all this for an audit is time-consuming.
60% of SOC2 audit preparation time is spent collecting and correlating evidence that should already be centralized.
What Vericto's audit trail records
Every query that passes through Vericto's proxy generates a record in the audit trail. The record includes:
- Millisecond-precision timestamp (UTC)
- Full query text (AES-256 encrypted, accessible only to the workspace)
- SHA-256 hash of the query (for correlation without decrypting)
- Decision: ALLOWED, BLOCKED, or PARSE_ERROR
- Triggered rule (for blocks): code, severity, and offending AST node
- Offending AST node with full path (e.g. DeleteStmt > WhereClause = NULL)
- Workspace and database identity
- Proxy processing latency (for SLA evidence)
Example record from the JSON export:
{
"event_id": "f47ac10b-58cc-4372-a567-0e02b2c3d479",
"timestamp": "2026-04-15T02:14:33.847291Z",
"workspace_id": "6ba7b810-9dad-11d1-80b4-00c04fd430c8",
"database": "prod-db",
"decision": "BLOCKED",
"rule_code": "VERICTO-001",
"severity": "critical",
"ast_node_path": "DeleteStmt > WhereClause = NULL",
"query_sha256": "e3b0c44298fc1c149afbf4c8996fb924...",
"estimated_rows_affected": 847293,
"latency_ms": 1.3,
"hmac_signature": "9f86d081884c7d659a2feaa0c55ad015..."
}Why it is immutable and why it matters
Immutability is what turns a log into audit evidence. A log that can be modified is not evidence: it is an editable document.
Vericto guarantees immutability with two mechanisms:
- Append-only: audit trail records are never modified or deleted by users or the system
- Ed25519 signature: each export includes a cryptographic signature of the complete file contents, verifiable offline with the workspace public key
When exporting the audit trail, Vericto includes an Ed25519 signature of the complete file. With the workspace public key, the auditor can independently verify offline that the export has not been modified since it was generated.
Which SOC2 criteria it directly satisfies
The most relevant SOC2 Trust Services Criteria for Vericto's audit trail are CC6 (Logical access control) and CC7 (System operations).
| Criterio | Descripción | Cómo lo satisface Vericto |
|---|---|---|
CC6.1 |
Logical access controls to data | The audit trail documents every write access and its block/allow decision |
CC6.3 |
Managing access to sensitive information | Custom rules can block operations on sensitive tables with full logging |
CC7.2 |
Monitoring anomalous activity | Real-time alerts on CRITICAL blocks document anomaly detection |
CC7.3 |
Evaluation of security events | Every blocked query includes the offending AST node and the severity for evaluation |
How to export evidence for the auditor
Every CLI run can emit a signed receipt: a self-contained record of what was evaluated and with what verdict, signed with Ed25519. The receipt is verified offline —no network, no account— with vericto verify-receipt, so the auditor confirms its authenticity independently. The Team plan and above also allow exporting the full audit trail for the period from the dashboard.
# En CI: evalúa y emite un recibo firmado del run
vericto check --changed --receipt vericto-receipt.json
# El auditor lo verifica offline, sin credenciales ni red
vericto verify-receipt vericto-receipt.json
# La clave pública de verificación se obtiene de:
# GET https://api.vericto.com/api/v1/meta/export-signing-keyThe receipt includes the run events with their Ed25519 signature, verifiable against the workspace public key. With the full audit trail for the period, the auditor can:
- Verify the Ed25519 signature of the exported file
- Filter by status = BLOCKED for the audit period
- Confirm that the rules active during the period are the expected ones (ruleset version)
- Correlate blocks with system changes (deploy log, incident log)
Data retention and audit deadlines
Retention periods depend on the contracted plan:
- Free plan: 7 days retention
- Builder plan: 30 days retention
- Team plan: 90 days retention
- Enterprise plan: configurable retention (up to 3 years)
For SOC2 Type II with a 12-month period, we recommend the Enterprise plan to ensure the complete audit trail is available throughout the audit period.
For Enterprise customers, Vericto can provide custom compliance reports in the specific format required by each auditor.
Beyond SOC2: ISO 27001 and GDPR
The same audit trail satisfies requirements from other compliance frameworks:
- ISO 27001 (Annex A, control A.8.15): Logging, system activity records
- GDPR Art. 32: Technical measures to ensure security of processing
The deterministic nature of AST parsing makes controls certifiable: the same input always produces the same result, and that result is documented in the audit trail.