Global · SOC 2
SOC 2 — Trust Services Criteria
SOC 2 reports assess controls against the AICPA Trust Services Criteria. RuleFix focuses on the controls that live in code and infrastructure, so your auditor sees consistent, evidenced engineering practice.
Example finding
rulefix scan --format json
{
"rule": "soc-2.missing-auth",
"framework": "SOC 2",
"severity": "high",
"file": "app/api/signup.ts",
"check": "Missing auth guards on API routes",
"status": "failed",
"fix": { "available": true, "files": 2 }
}Key requirements
What SOC 2 expects from engineering.
- 01
Logical access
Enforce least privilege, authentication and authorisation checks on every sensitive route.
- 02
Change management
Review, test and approve changes before they reach production.
- 03
Monitoring
Log security-relevant events and alert on anomalies.
- 04
Encryption
Protect confidential data in transit and at rest.
- 05
Availability
Back up critical data and plan for recovery.
- 06
Vendor management
Track third-party services that touch customer data.
What RuleFix checks
Turned into code rules.
- Missing auth guards on API routes
- Secrets committed to source
- Audit logging on privileged actions
- TLS enforcement
- Dependency and vendor inventory
Official sources
Read the source.
RuleFix links to primary sources so you can check the requirements yourself. We are not affiliated with these bodies.
Other frameworks
Cover more with the same workflow.
DPDP
GDPR
HIPAA
LGPD
Ship AI-powered products
that are compliant by design.
Join developers building with RuleFix.