Skip to main content

SOC2 Trust Service Criteria Mapping

Complete mapping of AuditSwarm controls to SOC2 Type II Trust Service Criteria.

Trust Service Criteria Overview​

CategoryNameStatus
CCSecurity (Common Criteria)Implemented
AAvailabilityImplemented
PIProcessing IntegrityImplemented
CConfidentialityImplemented
PPrivacyImplemented

CC: Security (Common Criteria)​

CC6.1 - Logical & Physical Access Controls​

"The entity implements logical access security software, infrastructure, and architectures over protected information assets."

Implementation:

ControlHow AuditSwarm Implements
AuthenticationOAuth2 authentication for all AI agents and users
RBACRole-based access control via Role and UserRole tables
Session ManagementAutomatic session expiry via NextAuth.js
MFA SupportMFA through configured OAuth providers (Google, Azure AD)

Evidence:

  • prisma/schema.prisma - User, Role, UserRole models
  • apps/web/src/lib/auth/ - NextAuth.js configuration
  • apps/mcp/src/ - OAuth 2.1 token validation

CC6.2 - System Operations​

"The entity implements system monitoring to detect and respond to security events."

Implementation:

ControlHow AuditSwarm Implements
Audit LoggingAuditLog table tracks all database operations
Performance MonitoringExecution time tracking (executionTimeMs field)
Health ChecksEndpoints at /api/health and /mcp/health
ContainerizationDocker for consistent deployments

Evidence:

  • AuditLog Prisma model with comprehensive fields
  • Health check endpoints in both web and MCP apps
  • infra/docker/ - Dockerfiles for all services

CC6.3 - Change Management​

"The entity implements logical access security to protect against unauthorized changes."

Implementation:

ControlHow AuditSwarm Implements
Suggestions PatternAll AI changes require explicit user approval
Data IsolationSuggestions stored separately from production data
Version Controlversion field on all auditable entities
Schema MigrationsPrisma migrations with version tracking

Evidence:

  • AISuggestion model stores pending changes as JSON
  • apps/web/src/lib/services/suggestion-approval.service.ts
  • packages/database/prisma/migrations/ directory

A: Availability​

A1.1 - System Availability​

"The entity maintains availability objectives."

Implementation:

ControlHow AuditSwarm Implements
High AvailabilityCloud Run auto-scaling (0-10 instances)
Health MonitoringHealth check endpoints for load balancers
CachingNext.js caching, Prisma connection pooling
Retry LogicAutomatic retry in API calls

Evidence:

  • infra/cloudbuild/ - Cloud Run deployment configs
  • Connection pooling in Prisma configuration

PI: Processing Integrity​

PI1.1 - Processing Accuracy​

"The entity maintains processing integrity in system operations."

Implementation:

ControlHow AuditSwarm Implements
Data IntegritySuggestions pattern prevents unauthorized modifications
TransactionsPrisma transactions for atomic operations
ValidationGraphQL schema-level validation
Type SafetyTypeScript throughout the codebase

Evidence:

  • GraphQL schema with Pothos type generation
  • TypeScript strict mode configuration
  • Prisma transaction support in approval workflows

C: Confidentiality​

C1.1 - Data Protection​

"The entity protects confidential information."

Implementation:

ControlHow AuditSwarm Implements
Encryption at RestField-level encryption for sensitive data (AES-256-GCM)
Encryption in TransitTLS/SSL for all connections
Secrets ManagementGCP Secret Manager for credentials
No API Key StorageAI agents bring their own LLM capabilities

Evidence:

  • apps/web/src/lib/utils/encryption.ts - AES-256-GCM implementation
  • Cloud Run HTTPS enforcement
  • GCP Secret Manager configuration

P: Privacy​

P1.1 - Personal Information Protection​

"The entity collects, uses, retains, and disposes of personal information in conformity with commitments."

Implementation:

ControlHow AuditSwarm Implements
User IsolationEach user sees only their own data and suggestions
GDPR ComplianceRight to access, rectification, erasure
Data MinimizationCollect only necessary information
Consent ManagementOAuth flow requires explicit consent

Evidence:

  • User-scoped queries in GraphQL resolvers
  • Soft delete support via status fields
  • OAuth consent flow implementation

Audit Trail Implementation​

The AuditLog table provides a tamper-proof audit trail:

CREATE TABLE AuditLog (
  id              BIGSERIAL PRIMARY KEY,
  userId          TEXT,
  sessionId       TEXT,
  correlationId   TEXT,
  actionType      TEXT NOT NULL,      -- CREATE, UPDATE, DELETE, VIEW
  operation       TEXT,
  entityType      TEXT,
  entityId        TEXT,
  tableName       TEXT NOT NULL,
  recordId        TEXT,
  oldValues       TEXT,               -- JSON of previous values
  newValues       TEXT,               -- JSON of new values
  changedFields   TEXT,
  ipAddress       TEXT,
  userAgent       TEXT,
  requestMethod   TEXT,
  requestUrl      TEXT,
  responseStatus  INT,
  errorMessage    TEXT,
  executionTimeMs INT,
  source          TEXT,
  timestamp       TIMESTAMP DEFAULT NOW()
);

Key Features:

  • Captures WHO (userId, sessionId)
  • Captures WHAT (actionType, entityType, entityId)
  • Captures WHEN (timestamp)
  • Captures HOW (requestMethod, requestUrl)
  • Preserves BEFORE/AFTER (oldValues, newValues)

Compliance Checklist​

SOC2 Requirements​

  • User authentication and session management
  • Comprehensive audit logging (AuditLog)
  • Change tracking (version fields)
  • Data encryption capabilities
  • Access control (RBAC)
  • Monitoring and alerting (SystemNotification)
  • Incident management workflow
  • Vendor management (via Dashboard)
  • Risk assessment (Risk table)
  • Control testing (Control table)

AI-Specific Controls​

  • All AI interactions logged in AuditLog
  • Suggestions require explicit human approval
  • AI cannot directly modify production data
  • Agent metadata captured for attribution
  • Full audit trail of AI suggestions and approvals