---
title: "SOC2"
description: "2 posts about SOC2, summarised, each linking to the original."
---

# SOC2
> 2 posts about SOC2, summarised, each linking to the original.

## Articles

### [Logbook - 2022-07-18](https://yomu.fyi/post/logbook-2022-07-18.md)
- Company: [Fly.io](https://yomu.fyi/company/fly-io.md)
- Published: Jul 18, 2022
- Type: Announcement

This Logbook entry records Fly.io product, platform, documentation, and interface changes on 2022-07-18. Highlights include $99 in usage credits for the Pro Plan, SOC2 compliance, persistent-volume expansion through fly volumes extend, SFTP access to apps over 6PN and WireGuard, and routing changes intended to improve latency. flyctl gained debug JSON formatting, expanded machine-app deployment and status commands, preserved mounted volumes during deployments, and added rolling deploys that wait for each VM to start. The entry also describes fixes for autoscaling, the Fly Redis image, GraphQL validation, Phoenix launches, and dashboard presentation, alongside updated Laravel and persistent-volume documentation and improved Heroku token-failure emails.


### [SOC2: The Screenshots Will Continue Until Security Improves](https://yomu.fyi/post/soc2-the-screenshots-will-continue-until-security-improves.md)
- Company: [Fly.io](https://yomu.fyi/company/fly-io.md)
- Published: Jul 7, 2022
- Type: Explainer

Fly.io’s SOC2 certification prompts an explanation of what the audit measures, when companies should pursue it, and what security value customers should assign to it. The post characterizes SOC2 as an accounting-style audit of documented company security processes, centered on an auditor-customized Document Request List (DRL) and screenshots, rather than adversarial product testing. It distinguishes Type I’s point-in-time snapshot from Type II’s multi-month confirmation and recommends doing the engineering work early, while delaying certification until customer demand justifies it. Fly.io prepared for more than a year and describes controls including Google SSO, certificate-based SSH access through Teleport, VPN gating, GitHub SSO, and session audit logs. The resulting certification improved processes but remains a weak positive security signal: SOC2 can miss much of a company’s technical security model, so penetration tests and clear security reporting still matter.