SOC2: The Screenshots Will Continue Until Security Improves

Summary

Fly.io’s SOC2 certification prompts an explanation of what the audit measures, when companies should pursue it, and what security value customers should assign to it. The post characterizes SOC2 as an accounting-style audit of documented company security processes, centered on an auditor-customized Document Request List (DRL) and screenshots, rather than adversarial product testing. It distinguishes Type I’s point-in-time snapshot from Type II’s multi-month confirmation and recommends doing the engineering work early, while delaying certification until customer demand justifies it. Fly.io prepared for more than a year and describes controls including Google SSO, certificate-based SSH access through Teleport, VPN gating, GitHub SSO, and session audit logs. The resulting certification improved processes but remains a weak positive security signal: SOC2 can miss much of a company’s technical security model, so penetration tests and clear security reporting still matter.

Takeaways

1. 1

   SOC2 evaluates documented company processes, not whether an attacker can exploit a product vulnerability such as SQL injection.

2. 2

   Type I is a point-in-time snapshot, while Type II checks adherence over several months; claims made in Type I bind on the later Type II.

3. 3

   Fly.io used Google SSO, certificate-based SSH access through Teleport, VPN and GitHub SSO authentication, and transcript-level SSH audit logs.