---
title: "SOC2: The Screenshots Will Continue Until Security Improves"
description: "Fly.io’s SOC2 certification prompts an explanation of what the audit measures, when companies should pursue it, and what security value customers should assign to it. The post characterizes SOC2 as an accounting-style audit of documented company security processes, centered on an auditor-customized Document Request List (DRL) and screenshots, rather than adversarial product testing. It distinguishes Type I’s point-in-time snapshot from Type II’s multi-month confirmation and recommends doing the engineering work early, while delaying certification until customer demand justifies it. Fly.io prepared for more than a year and describes controls including Google SSO, certificate-based SSH access through Teleport, VPN gating, GitHub SSO, and session audit logs. The resulting certification improved processes but remains a weak positive security signal: SOC2 can miss much of a company’s technical security model, so penetration tests and clear security reporting still matter."
---

# SOC2: The Screenshots Will Continue Until Security Improves

[Fly.io](https://yomu.fyi/company/fly-io) · Jul 7, 2022

**Type:** Explainer

## Summary

Fly.io’s SOC2 certification prompts an explanation of what the audit measures, when companies should pursue it, and what security value customers should assign to it. The post characterizes SOC2 as an accounting-style audit of documented company security processes, centered on an auditor-customized Document Request List (DRL) and screenshots, rather than adversarial product testing. It distinguishes Type I’s point-in-time snapshot from Type II’s multi-month confirmation and recommends doing the engineering work early, while delaying certification until customer demand justifies it. Fly.io prepared for more than a year and describes controls including Google SSO, certificate-based SSH access through Teleport, VPN gating, GitHub SSO, and session audit logs. The resulting certification improved processes but remains a weak positive security signal: SOC2 can miss much of a company’s technical security model, so penetration tests and clear security reporting still matter.

## Context

Customers routinely demand SOC2 reports, while startups may overestimate the difficulty and expense of certification. The post addresses conflicting views of SOC2 by explaining its actual scope, customer significance, timing, and limitations.

## Approach / What changed

Fly.io prepared for SOC2 for more than a year, implemented process and access controls, and then completed an audit based on a customized Document Request List and screenshot evidence. The post recommends completing the underlying engineering work early, keeping Type I claims modest, and postponing certification until customer demand makes it worthwhile.

## Takeaways

- SOC2 evaluates documented company processes, not whether an attacker can exploit a product vulnerability such as SQL injection.
- Type I is a point-in-time snapshot, while Type II checks adherence over several months; claims made in Type I bind on the later Type II.
- Fly.io used Google SSO, certificate-based SSH access through Teleport, VPN and GitHub SSO authentication, and transcript-level SSH audit logs.

**Tags:** [Compliance](https://yomu.fyi/topic/compliance), [Security](https://yomu.fyi/topic/security), [SOC2](https://yomu.fyi/topic/soc2)

- Source: [Fly.io](https://fly.io/blog/soc2-the-screenshots-will-continue-until-security-improves)
- Source URL: https://fly.io/blog/soc2-the-screenshots-will-continue-until-security-improves
- Ingested by Yomu: 2026-09-02T11:59:15.273Z

[Read original post](https://fly.io/blog/soc2-the-screenshots-will-continue-until-security-improves)