From Zero to SOC 2 Compliant: How FlowSquad's Audit Trail, RBAC, and Encryption Support the Certification

What SOC 2 Trust Service Criteria Does FlowSquad Address?

SOC 2 is built on five Trust Service Criteria (TSC): Security, Availability, Processing Integrity, Confidentiality, and Privacy. The most commonly audited — and the most complex to evidence — is the Security category, specifically the CC6 (Logical and Physical Access) series. FlowSquad's security architecture was designed with these criteria in mind, because the platform itself handles sensitive artifacts: LLM API keys, codebase data, design documents, and user management.

The table below maps the key SOC 2 criteria to the specific FlowSquad features that provide evidence. This mapping is the starting point for preparing your SOC 2 readiness documentation.

How Does FlowSquad's Audit Log Support SOC 2 CC6?

The SOC 2 CC6 criteria require that you demonstrate who accessed what, when, and what they did. FlowSquad's audit logs capture every user action at the application layer with five mandatory fields: timestamp (UTC, millisecond precision), user ID, action type, resource affected, and IP address. Logs are written to an append-only table in PostgreSQL and cannot be modified by any user role — not even global admin.

The most commonly requested audit log export during a SOC 2 Type II audit covers a 90-day lookback window. FlowSquad's admin panel exports this as CSV or JSON with one click, filtering by user, action type, date range, or resource. The export is timestamped and cryptographically signed, giving auditors confidence the log has not been tampered with since export.

# Sample audit log entry (JSON format)
{
  "event_id": "evt_01HZ9M2X...",
  "timestamp": "2026-03-15T09:14:22.847Z",
  "user_id": "usr_jane_doe",
  "user_email": "jane@example.com",
  "role": "analyst",
  "action": "story.generate",
  "resource_type": "epic",
  "resource_id": "epic_0042",
  "ip_address": "192.168.1.44",
  "session_id": "sess_XwQ...",
  "outcome": "success",
  "llm_provider": "openai",
  "tokens_used": 1842
}

How Does RBAC Enforce the Principle of Least Privilege?

SOC 2 CC6.3 requires that system access is granted based on job function and revoked promptly when no longer needed. FlowSquad's RBAC implements 5 role tiers that map cleanly to the job functions in an SDLC team, ensuring no user has more access than their role requires.

Role assignments are logged in the audit trail — every grant, revocation, and modification. Auditors typically ask for an "access matrix" showing which users have which roles on which systems. FlowSquad exports this directly from the admin panel as a CSV. For SOC 2 Type II, you will need to demonstrate that you performed a quarterly access review — FlowSquad's admin panel includes a one-click "Access Review Report" button specifically to support this control.

How Does Field-Level Encryption Satisfy CC6.1?

SOC 2 CC6.1 requires protection of logical access credentials, including encryption of stored credentials. FlowSquad applies field-level encryption using Fernet (AES-128-CBC with HMAC-SHA256) to every sensitive field stored in PostgreSQL: LLM provider API keys, database credentials, OAuth tokens for GitHub/Jira/Confluence integrations, and SAML private keys.

The encryption key is stored separately from the database — in a Kubernetes Secret or external secrets manager (Vault, AWS Secrets Manager, Azure Key Vault). This means a database dump alone is useless without the encryption key — a critical separation that SOC 2 auditors explicitly look for under CC6.1's "logical access security measures."

Quarterly key rotation is a SOC 2 operational best practice. FlowSquad's key rotation wizard re-encrypts all stored secrets with a new Fernet key without downtime, completing in under 4 minutes for a typical deployment with 50 stored credentials. The rotation event is recorded in the audit log with the timestamp and the admin user who initiated it.

How Does MFA Reduce Access Risk?

SOC 2 CC6.6 requires that system access is protected against unauthorized access, including multi-factor authentication for remote access. FlowSquad supports MFA (TOTP-based, compatible with Google Authenticator, Authy, and 1Password) enforced at the platform level. When auth.mfaRequired: true is set in the Helm values, users cannot log in without MFA — there is no opt-out at the user level.

Industry data shows that MFA blocks 99.9% of automated account takeover attacks (Microsoft Security, 2023). For SOC 2, the evidence requirement is an MFA enrollment report showing that 100% of users have MFA enabled. FlowSquad's admin panel exports this report in one click, showing each user's MFA status and enrollment date.

What Does a SOC 2 Auditor Look for That FlowSquad Provides Out of the Box?

SOC 2 auditors conduct walkthroughs of your environment to verify controls are operating as described. Based on common audit findings, the table below lists the most frequent requests during a SOC 2 Type II audit and where each FlowSquad feature satisfies the request.