SOC 2 Compliance
Term 4 of 68 in the ERPStack technical glossary
What is SOC 2 Compliance?
System and Organization Controls (SOC) 2 is a voluntary compliance standard for service organizations, developed by the AICPA, specifying how companies must manage customer data based on five Trust Services Criteria: security, availability, processing integrity, confidentiality, and privacy.
SOC 2 Compliance at a glance
- Framework
- AICPA Trust Services Criteria — 5 categories, of which only Security is mandatory
- Report types
- 2: Type I tests design at 1 point in time, Type II tests operation over a period
- Technical evidence
- Role-Based Access Control, immutable audit logs, encryption and change management
- Honest framing
- ERPStack holds 0 certifications; we build systems designed to be auditable against these criteria
- Built with
- RBAC and SSO on Next.js 16, PostgreSQL 18 audit tables through Drizzle ORM 0.45, infrastructure in Terraform, changes gated by GitHub Actions, Semgrep SAST scans, errors in Sentry
- Numbers that matter
- 5 Trust Services Criteria, 1 mandatory; 2 report types; ERPStack holds 0 certifications; Type II evidence produced continuously, not for 1 date
- Adjacent regimes
- ISO 27001, HIPAA, GDPR, PCI DSS and FedRAMP Security Controls
- Evidence toolchain
- SSO, RBAC, GitHub Actions change history, Semgrep SAST and Sentry
How SOC 2 Compliance works in production
The ERPStack approach to SOC 2 Compliance
We build all our custom ERP and SaaS systems with SOC 2 compliance in mind. This includes built-in role-based access control (RBAC), end-to-end database encryption, secure environment variable handling (via Env.ts), and automated audit logs.
Frequently asked questions about SOC 2 Compliance
What does SOC 2 Compliance actually assess?
Controls, not software. A SOC 2 examination evaluates an organisation's controls against the AICPA Trust Services Criteria, of which Security is mandatory and Availability, Processing Integrity, Confidentiality and Privacy are included only if in scope. Compliance is therefore a property of how a company operates, and the platform's job is to make the evidence — access records, change history, audit logs — cheap to produce rather than reconstructed under pressure.
What is the difference between Type I and Type II?
Time. A Type I report says controls were suitably designed at 1 date; a Type II report says they operated effectively across an observation period, which is why buyers ask for it. For Compliance purposes that distinction shapes engineering: Type II evidence must be produced continuously by the system, because it cannot be assembled retrospectively for a window that has already passed.
Which parts of SOC 2 are engineering problems?
The ones that leave traces. Access provisioning and removal, least-privilege enforcement through Role-Based Access Control, encryption in transit and at rest, change management through reviewed pull requests, and an immutable audit trail behind every data change. Compliance also covers policies, vendor management and training, which are organisational — but the technical half is where retrofitting is most expensive.
Can a software vendor make you SOC 2 compliant?
No, and any claim otherwise should be treated as a warning. Compliance is awarded to an organisation after an independent examination of its own controls. ERPStack holds no certification and does not confer one; what we can do is build systems whose access model, logging and change management produce the evidence an auditor asks for, so the examination tests reality rather than intention.