SOC 2 engineering for SaaS teams: we build the controls, your auditor tests them
A SOC 2 report comes from an independent CPA firm. Before it, your engineering team has to show change management, access control, monitoring, infrastructure as code, recovery and vulnerability gates that work. We do that engineering work. We do not audit, attest or certify.
- Your CPA firm
- Tests your controls and issues the report
- Your company
- Our engineers build the engineering controls in your accounts
- Clouditive
Clouditive does not audit, attest or issue SOC 2 reports
The audit
What does a SOC 2 audit need from engineering?
A SOC 2 report is an attestation that an independent CPA firm issues against the AICPA's Trust Services Criteria for security, availability, processing integrity, confidentiality and privacy. The auditor tests the controls you run. Most of them sit in engineering: how code reaches production, who has access, what is logged and watched, how infrastructure is defined, whether you can recover and how vulnerabilities are caught.
Your auditor decides what evidence it needs. Our work is the engineering behind it: pipelines, access paths, monitoring and recovery that leave records an auditor can read.
What we do not do
What do we not do?
We are not a CPA firm. We do not audit, attest, certify or issue SOC 2 reports, and we claim no SOC 2 or ISO 27001 certification for Clouditive or for any client. The vulnerability gate in our fintech case is SOC 2-oriented: it targets the controls the framework asks about, and it is not a certification.
- Policies, risk assessment and the choice of auditor stay with your company. This page makes no claim about them.
- We claim no partnership with any compliance-automation (GRC) platform.
- HIPAA, ISO 27001, PCI DSS and GDPR/LGPD have their own pages under compliance engineering, each with what we have shown and what we do not claim.
- We guarantee no audit outcome: the opinion is the auditor's.
The controls
Which engineering controls does an audit ask about?
Six areas of engineering work come up in an audit: change management, access control, logging and monitoring, infrastructure as code, backups and recovery, and vulnerability management. For each one: what the auditor asks, the engineering work, and where we have done it in a published case.
Change management
What it asks of engineeringHow does a change get approved, tested and released, and can you show the record?
Changes reach production through a pipeline whose gates can stop a release, and every release is a traceable version with a rehearsed way back.
- Automatic checks that can block a bad release before production.
- Release by tag and deploy by image digest, with a read-back that production runs the build that was tested.
- A rollback that is rehearsed, not assumed.
Where we have done it
- Production waits an hour under watch and must pass health and error-rate gates. Rollback by re-promotion was rehearsed in dev: 72 seconds back, 124 seconds forward.Read the fintech release pipeline case
- A release tag builds the images, runs the migrations, deploys by image digest and reads back the digest that is actually live.Read the AI marketing platform case
- Each release is a cosign-signed image, deployed with no traffic, health-checked and then promoted.Read the GovTech coordination portal case
Delivered by
- CI/CD & IaC build or re-architectureUSD 4,000 · 2 weeks
- QA Automation FoundationsUSD 5,000 · 2 weeks
Access control
What it asks of engineeringWho can reach production and data, who approved it, and is access removed when someone leaves?
Engineers get access through your own accounts and identities, with your SSO, MFA and least privilege, and we revoke it when the engagement ends. The periodic review of who has access is performed by your team. Our side is the engineering: secrets in a managed store, and workload identity for services where the platform offers it.
Where we have done it
- Secrets live in a managed secrets store, and the vulnerability gate runs on every merge request.Read the fintech release pipeline case
- Cloud SQL runs on a private IP, with KMS and Workload Identity.Read the AI marketing platform case
- Gmail delivery uses domain-wide delegation, so no mail key is stored.Read the GovTech coordination portal case
- The observability stack is read in Grafana with single sign-on.Read the transportation platform case
No fixed package covers access control on its own. We scope it in Discovery or with engineers by the hour.
Logging and monitoring
What it asks of engineeringWhat do you log, who watches it, and do the alerts fire when they should?
Metrics, logs and traces are wired, alerts are tested until they fire, and a runbook tells whoever responds what to do. We work in your business hours and leave alerts and runbooks so your own on-call can resolve incidents.
Where we have done it
- From zero production alerts to 275 alerting rules, each tested until it fired.Read the fintech release pipeline case
- OpenTelemetry collectors on every cluster send to central Mimir, Loki, Tempo and Pyroscope. Dashboards went from 18 to 135.Read the transportation platform case
- OpenTelemetry traces go to Google Cloud and 18 alert policies watch the service.Read the AI marketing platform case
Delivered by
- SRE / Observability FoundationsUSD 5,000 · 2 weeks
Infrastructure as code
What it asks of engineeringIs infrastructure defined in code and applied through a pipeline, and does anything stop a destructive change?
Infrastructure is defined in Terraform or OpenTofu with encrypted state, and a plan that would destroy a resource stops before it applies.
Where we have done it
- Terraform and OpenTofu with Atlantis. The move to Crossplane runs as zero-downtime cutovers, each with a rollback.Read the fintech release pipeline case
- The whole Google Cloud platform is OpenTofu, covered by 43 mocked-provider tests that run without touching the cloud account.Read the AI marketing platform case
Delivered by
- CI/CD & IaC build or re-architectureUSD 4,000 · 2 weeks
Backups and recovery
What it asks of engineeringAre there backups, and has anyone shown that a restore works?
Recovery is shown by drills rather than assumed.
Where we have done it
- A snapshot of the database is taken automatically before each migration runs, and rollback was rehearsed in dev.Read the fintech release pipeline case
- Backups are encrypted and scheduled, and the restore drill brings the data back in 13 seconds.Read the online RPG platform case
No fixed package covers backups and recovery on their own. We scope them in Discovery or with engineers by the hour.
Vulnerability management
What it asks of engineeringHow do you find known vulnerabilities and secrets before code ships, and what happens to an exception?
Scans run in the pipeline on every change, and a suppressed finding expires instead of staying forever.
Where we have done it
- A SOC 2-oriented vulnerability gate runs on every merge request, with suppressions that expire. It is not a certification.Read the fintech release pipeline case
- Since February 2026 a shared workflow runs dependency, secret, CodeQL and container scans. CI supply-chain hardening is in progress.Read the transportation platform case
- A push gate checks secrets, types, lint and build before code leaves the engineer's machine.Read the GovTech coordination portal case
Delivered by
- CI/CD & IaC build or re-architectureUSD 4,000 · 2 weeks
How we deliver
How do our packages and engineers deliver it?
Start with a fixed-price package, or hire engineers by the hour. The CI/CD & IaC package builds the pipeline and the infrastructure as code. SRE / Observability Foundations wires the monitoring. QA Automation Foundations puts tests in your CI. Discovery turns what you have, and what your auditor asked for, into a roadmap with a backlog.
Pipeline and infrastructure as code
A 2-week build or re-architecture of your CI/CD pipelines and your infrastructure as code. The gates that go into the pipeline, such as a vulnerability scan, are agreed in the SOW.
Delivered by
- CI/CD & IaC build or re-architectureUSD 4,000 · 2 weeks
Logging and monitoring
Metrics, logs and traces wired, 3 SLOs defined, alerts tested until they fire, and a runbook.
Delivered by
- SRE / Observability FoundationsUSD 5,000 · 2 weeks
Tests on every change
A Playwright suite for your 5 critical flows, running in your CI, with accessibility checks.
Delivered by
- QA Automation FoundationsUSD 5,000 · 2 weeks
From the auditor's list to a backlog
Discovery understands your product and its configuration end to end and delivers a roadmap with a backlog, roles, critical changes and needs. Bring your auditor's findings and we turn them into engineering work.
Delivered by
- DiscoveryUSD 7,000 · 1–4 weeks
Engineers by the hour
For the work that continues after a package: Senior USD 45–50 an hour, Lead or Architect USD 55–60, with a 6-month minimum, billed per hour worked. You interview the engineer who will do the work.
Frequently asked questions
Are you SOC 2 certified?
SOC 2 is not a certification: it is a report that an independent CPA firm issues. We claim no SOC 2 report or ISO 27001 certificate for Clouditive. What we do is the engineering an auditor tests: pipelines, access, monitoring and recovery.
Can Clouditive audit us or issue our SOC 2 report?
No. Only a CPA firm can issue a SOC 2 report, and Clouditive is not one. We build and run the engineering controls; your auditor tests them and writes the report.
What engineering work does a SOC 2 audit involve?
Change management through a gated pipeline, access control, logging and monitoring, infrastructure as code, backups and tested recovery, and vulnerability management. Each is described above with the published case where we did it.
How long does it take to get ready?
It depends on what you already have, and we give no guarantee about an audit. A 2-week package builds one area, such as the CI/CD pipeline and infrastructure as code, and Discovery, 1 to 4 weeks, turns the rest into a roadmap.
Does the fintech case mean that client is SOC 2 compliant?
No. The vulnerability gate in that case is SOC 2-oriented: it targets the controls the framework asks about. It is not a certification of the client or of Clouditive.
Do you work with a compliance-automation platform?
We claim no partnership with any compliance-automation (GRC) platform, and this page recommends none. If you use one, tell us on the first call.
Do you cover HIPAA, ISO 27001 or PCI DSS?
Yes, as engineering toward their controls, never as an assessor. Each has its own page under compliance engineering with the controls, the cases that show the transferable work and what we do not claim. For HIPAA we sign a BAA when the work touches PHI.
How do your engineers get access to our systems?
Through your own accounts and identities, with your SSO, your MFA and least-privilege access, revoked when the engagement ends. Every engineer passes a background check before assignment.
Who does the work?
Mat Caniglia leads every project end to end, and the engineers are in LATAM and share your working day. We present candidates within 1 week, and you interview the engineer who will do the work.
Tell us your case.
We reply to every request within 1 business day. We sign an NDA before the call if you ask.