ProBeya's SOC 2 module provides a readiness assessment dashboard, automated evidence collection, and control mapping against the AICPA Trust Service Criteria (Security, Availability, Processing Integrity, Confidentiality, Privacy).
Overview
SaaS platforms serving enterprise customers need to demonstrate SOC 2 compliance. ProBeya helps organizations:
- Assess readiness: Interactive checklist covering all five trust service categories
- Collect evidence: Automated gathering of access logs, encryption status, backup records, and change management artifacts
- Generate reports: Evidence packages formatted for SOC 2 auditor consumption
- Track remediation: Gap analysis with action items for non-compliant controls
Getting Started
- Navigate to Compliance > SOC 2 Dashboard.
- Review the readiness checklist organized by trust service category.
- Click each control to see its status, evidence, and any gaps.
- Use Generate Evidence Package to compile all evidence for your auditor.
- Track remediation actions for any identified gaps.
Trust Service Criteria Coverage
Security (Common Criteria)
The Security category covers the foundational controls that protect the system against unauthorized access:
| Control | ProBeya Implementation | Evidence Source |
|---|
| CC6.1 Access controls | Role-based access with orgProcedure, createRoleProtectedProcedure | Membership and role audit logs |
| CC6.2 MFA enforcement | Auth.js v5 with configurable MFA policies per organization | Authentication event logs |
| CC6.3 Encryption at rest | PostgreSQL TDE, S3 server-side encryption (SSE-S3) | Database and S3 configuration snapshots |
| CC6.6 Encryption in transit | TLS 1.2+ enforced on all endpoints, HSTS headers | TLS certificate records, middleware config |
| CC6.7 Vulnerability management | Dependency scanning, container image scanning | CI/CD pipeline artifacts |
| CC6.8 Change management | Git-based workflow, PR reviews, deployment logs | Git history and deployment records |
Availability
| Control | ProBeya Implementation | Evidence Source |
|---|
| A1.1 Uptime monitoring | /api/health endpoint checking DB, Redis, S3 connectivity | Health check response logs |
| A1.2 Backup verification | Automated PostgreSQL backups with point-in-time recovery | Backup schedule and restore test records |
| A1.3 Disaster recovery | Multi-AZ deployment with failover, documented RTO/RPO targets | DR test records and runbooks |
Processing Integrity
| Control | ProBeya Implementation | Evidence Source |
|---|
| PI1.1 Input validation | Zod schemas on all tRPC procedures and form submissions | Schema definitions in @probeya/shared |
| PI1.2 Data accuracy | Server-side computation for derived values (e.g., timer durations, EVM metrics) | Audit trail activity logs |
| PI1.3 Audit trail completeness | logActivity helper logs all mutations with actor, entity, and metadata | Activity log query results |
Confidentiality
| Control | ProBeya Implementation | Evidence Source |
|---|
| C1.1 Data classification | Multi-tenant isolation via organizationId on all scoped tables | Schema definitions showing organizationId columns |
| C1.2 Access logging | Authentication events, API key usage, embed token access tracking | Auth and API key audit logs |
| C1.3 Retention policies | Configurable data retention periods per organization | Organization settings snapshots |
Privacy
| Control | ProBeya Implementation | Evidence Source |
|---|
| P1.1 Consent management | Terms acceptance tracking during onboarding | User consent records |
| P1.2 Data subject rights | User data export and deletion capabilities | Data export and deletion audit logs |
| P1.3 Data minimization | Embed public data strips PII (user emails, internal IDs) | Embed data sanitization code review |
How It Works
Readiness Checklist
The SOC 2 dashboard presents controls organized by trust service criteria. Each control has a status indicator:
| Status | Description |
|---|
| Implemented | Control is fully in place with sufficient evidence |
| Partial | Control exists but evidence is incomplete or coverage is insufficient |
| Missing | Control is not yet implemented |
| N/A | Control is not applicable to the organization's scope |
Automated Evidence Collection
The system automatically gathers evidence from ProBeya's own operational data:
- Access logs: Authentication events, permission changes, session management from Auth.js
- Encryption status: Database encryption configuration, TLS settings, S3 bucket policies
- Change management: Git commit history, deployment timestamps, code review records
- Monitoring: Health check response history, error rate metrics, performance data
- Tenant isolation: Query logs showing
organizationId filtering on all data access
Evidence Package Generation
The Generate Evidence Package feature compiles all collected evidence into a structured archive suitable for SOC 2 auditors. The package includes:
- Control-by-control evidence mapping with timestamps
- System architecture diagrams and data flow documentation
- Access control matrix showing roles and permissions
- Change management records for the audit period
- Monitoring and alerting configuration documentation
For each control that is not fully implemented, the system generates:
- A description of the gap and its risk impact
- Recommended remediation steps
- Priority level based on the control's importance
- An action item that can be tracked through ProBeya's action management system
API Reference
| Procedure | Type | Description |
|---|
soc2.getReadiness | Query | Get SOC 2 readiness status by category |
soc2.getControls | Query | List all controls with status and evidence |
soc2.generateEvidence | Mutation | Compile evidence package for auditor |
soc2.updateControl | Mutation | Update control status and attach evidence |
Permissions
| Action | Required Role |
|---|
| View SOC 2 dashboard | Admin or Compliance role |
| Generate evidence package | Admin |
| Update control status | Admin or Compliance role |