SOC 2 Aligned Software Development

What SOC 2 asks of the software you build

SOC 2 is an attestation report issued by a licensed CPA firm against the AICPA Trust Services Criteria. It is not a certification, and it does not prescribe technologies. The auditor examines whether your controls are designed well (Type 1) and whether they operated consistently over a period (Type 2). Many controls live in your policies and HR practices, but a large share live in how your software is built, deployed and run.

That is where Tepia works. When we build a SaaS product, a customer portal or an integration layer connecting your business systems, we design access control, change management, logging and data handling to line up with the criteria. Tepia does not perform audits or issue reports. We build the system so the evidence already exists when your auditor or compliance platform asks for it.

Integration projects deserve extra care. Each connection between your CRM, ERP, payment processor and app is a new path to data and a new vendor in your risk register, so auditors look closely at how those connections authenticate, what they can reach and how failures are tracked.

Controls Tepia builds into the code and pipeline

The table below maps common criteria areas to what gets built and the evidence each produces:

Defining infrastructure in code with tools such as Terraform means the configuration an auditor sees in a screenshot matches what sits in version control, with its own change history.

Where integrations create audit findings

The findings Tepia sees most often in connected systems are not exotic. They are API keys pasted into configuration files, one shared admin account used by three integrations, a sync that copies customer data into a spreadsheet, and automation tools connected with full admin rights because the narrower scope took longer to set up. Each is easy to fix early and painful to fix during an audit window.

• Secrets live in AWS Secrets Manager or Azure Key Vault and rotate on a schedule.
• Each integration has its own service account with the narrowest scopes the target API allows.
• Sync jobs log what moved, when and why, without writing sensitive fields into the logs.
• Data copied between systems is limited to the fields the destination truly needs.

Compliance automation platforms such as Vanta and Drata connect to your cloud accounts, code repositories and identity provider to check controls continuously. Tepia structures infrastructure and repositories so those checks pass and stay passing. Identity is covered in more depth on our SSO and identity integration page, and broader controls on our security and compliance page.

How Tepia approaches SOC 2 aligned development

1. Discovery: a review of your system boundary, data flows, existing policies and any prior audit findings, plus interviews with engineering, security and operations. Deliverables are an Investigation Summary, an Interview Summary and User Stories that include control requirements, such as an admin exporting a quarterly access review.
2. Design: a design questionnaire, style guide and wireframes for admin screens like role management, audit log search and export approvals, plus an architecture that marks where each control lives.
3. Development and Testing: Alpha and Beta releases through a pipeline that enforces review and testing, with functional, user acceptance and non functional test plans covering access rules, logging completeness and backup restores.
4. Training: sessions for your engineers and admins on the change process, access reviews and incident runbooks.
5. Launch: data migration with documented handling of sensitive fields, cutover from the old system, and a control handoff document mapping features to criteria.
6. Support: issue resolution, bug tracking, dependency and security patching, and feature requests, all through the same reviewed change process.

Typically Discovery takes 1 to 3 months, development and QA 2 to 6 months, and launch about a month. See our process.

What Tepia handles and what stays with your team

A SOC 2 program covers more than software, and a clear split avoids surprises. Tepia builds and documents the technical controls in the systems we deliver, can operate the pipeline and hosting when you ask, and answers auditor questions about how those systems work. Your team owns the policies, risk assessment, background checks, security awareness training, vendor contracts and the choice of audit firm.

If you already have a product and an audit coming, Tepia can start with a gap review of the codebase and cloud configuration, then fix findings in priority order through a reviewed process. If you are building something new for customers who will ask for a SOC 2 report, the easiest time to build these controls is before launch. Our SaaS product development and DevOps and CI/CD pages show how they fit a new build. Talk to Tepia about your audit timeline.

Tepia also keeps a short system description for everything it delivers: what the system does, where its data lives, which third parties it connects to and which controls apply. Auditors usually ask for exactly this early in an engagement, and having it written by the people who built the system saves weeks of back and forth.

Frequently asked questions