SOC 2 · Available
SOC 2, done in your systems.
A customer asked for your SOC 2 report. Deixic changes the settings behind the failing tests in the systems you already run, reads each change back, and keeps the evidence your auditor asks for.
What SOC 2 is
SOC 2 is a report from an independent audit firm. It states whether your controls meet the AICPA Trust Services Criteria. Customers ask for it before they send you their data.
Type I and Type II
A Type I report says your controls were in place on one date. A Type II report says they operated for a period, and the auditor tests that with samples from the whole period. Type II needs an observation window before the auditor can issue it.
What an auditor samples
- A sample of new hires, with the approval and the date each person got access.
- A sample of people who left, with the date each account lost access.
- A sample of code changes, with the review each one received before it shipped.
- Screenshots or exports of MFA, logging, and endpoint settings on the dates tested.
The five Trust Services Criteria
- SecurityRequired in every report. Access, change management, monitoring, and risk.
- AvailabilityOptional. You commit to uptime and recovery, and the auditor tests it.
- ConfidentialityOptional. You commit to protect data marked confidential.
- Processing integrityOptional. Your system processes data completely, accurately, and on time.
- PrivacyOptional. You handle personal information as your notice says.
Source: AICPA Trust Services Criteria (2017, with revised points of focus 2022)
The path to a report
Eight steps. Deixic does four of them. You decide the other four. Read the first-report walkthrough.
- 01Pick the scope and the criteriaDecide which systems and which criteria go in the report. Security is required. Add another criterion when a customer contract or your own commitments call for it.You decide
- 02Choose an auditorYou pick the audit firm and sign with it. The firm bills you directly.You decide
- 03Connect your systemsConnect identity, code host, cloud, HR, devices, and Slack for approvals. Connect the compliance platform you already pay for, if you have one.Deixic does
- 04Write the policiesDeixic works inside your written policy. You set the policy, including how fast access is removed when someone leaves.You decide
- 05Fix the failing testsDeixic reads the SOC 2 controls against your live settings, changes the ones that fail within the authority you grant, and reads each change back.Deixic does
- 06Approve and decideSensitive changes wait for a named approver and a reason. Decisions only your company can make come to you as a question.You decide
- 07Run the observation windowA Type II report tests a period of time. Deixic keeps re-running the tests and recording each result and receipt for that whole period.Deixic does
- 08Hand the evidence to the auditorThe auditor receives the receipts and test results, samples them, and issues the report.Deixic does
Where the work happens
Each page lists the SOC 2 tests Deixic fixes in that system and what waits for approval. Hundreds more systems connect; browse the connectors.
- Google WorkspaceEnforces MFA and suspends terminated users.CC6.1CC6.2CC6.3
- Microsoft 365Reads users and groups, and sends access changes to you as decisions.CC6.1CC6.2CC6.3
- GitHubTurns on required reviews and branch protection.CC8.1CC6.2CC6.1
- AWSRemoves stale IAM users and unused admin roles, and turns on CloudTrail.CC6.1CC6.3CC7.2
- GCPRemoves stale service account keys and owner grants, and turns on audit logs.CC6.3CC6.2CC7.2
- OktaReads users, groups, and logs, and sends identity policy changes to you as decisions.CC6.1CC6.2CC7.2
- RipplingReads employee status and devices, and triggers offboarding fixes elsewhere.CC6.2CC6.3
- GustoReads hires and terminations, and triggers access fixes elsewhere.CC6.2CC6.3
- Device managementChecks disk encryption and screen lock, and enforces them in Deixic device management.CC6.8CC6.1
- SlackWhere approvers see a change, read the reason, and decide.CC8.1CC7.2
Where Deixic acts in each control
Each cell names what Deixic does in that system for that control.
| System | CC6.1 | CC6.2 | CC6.3 | CC6.8 | CC7.2 | CC8.1 |
|---|---|---|---|---|---|---|
| Google Workspace | fixes | fixes | fixes | – | – | – |
| Microsoft 365 | reads | reads | reads | – | – | – |
| GitHub | fixes | fixes | – | – | – | fixes |
| AWS | fixes | – | fixes | – | fixes | – |
| GCP | – | fixes | fixes | – | fixes | – |
| Okta | reads | reads | – | – | reads | – |
| Rippling | – | reads | reads | – | – | – |
| Gusto | – | reads | reads | – | – | – |
| Device management | fixes | – | – | fixes | – | – |
| Slack | – | – | – | – | reads | approval |
What happens to every failing test
The same seven steps run in each system, and each change ends in a receipt.
- 01EvaluateReads the SOC 2 controls against your live settings
- 02FixChanges failing settings within your written policy
- 03ApproveWaits for a named approver and a reason on sensitive changes
- 04RefuseSends out-of-authority actions to you as a decision
- 05Read backReads every change back from the system
- 06EvidenceAttaches it to the test in your compliance platform, or keeps it in Deixic
- 07Re-runRuns the test again and records the result
Each receipt holds the before and after state, the approver and reason, and the read-backs. It is signed, hash-linked, and exports as PDF, HTML, or JSON. See what the auditor receives. Your own agents, such as Claude Code and Codex, read the same records over MCP.
The controls behind the tests
Each control page lists the tests that fail, the change Deixic makes, who authorizes it, and the evidence the auditor receives. See all six controls.
Price
SOC 2 compliance execution costs $6,000 a year plus a per-asset price. A company with 50 managed assets pays $12,500 a year. Your auditor bills you separately. See pricing.
Questions about your first report
Do I need a Type I report first?
No. Type I tests your controls on one date. Type II tests them over a period. Read what your customer wrote: if the request says Type II, a Type I report does not answer it.
Which criteria do I need?
Security, because every report includes it. Add Availability if you promise uptime in your contracts, Confidentiality if customers send you data they mark confidential, Processing Integrity if you process data on their behalf, and Privacy if you handle personal information. Each added criterion adds controls to test.
Do I need a compliance platform?
Deixic does not require one. If you already use one, Deixic connects to it, reads its failing tests, fixes the settings behind them, uploads the evidence, and re-runs the tests there. If you do not, Deixic keeps the evidence and the receipts itself.
Do I need to hire someone for compliance?
Deixic makes the setting changes, so nobody on your team has to work through the failing tests. A person at your company still approves sensitive changes and answers the decisions Deixic sends, such as how fast access must be removed.
Who picks the auditor?
You do. You contract with the audit firm and it bills you directly. Deixic prepares the evidence the firm asks for and does not issue the report.
What happens after the report?
The report covers a set period, so customers ask for a new one when it ends. The tests keep running in the meantime and each result is recorded, so the next period starts with its evidence already collected.