SOC 2 Compliance on the PushOps Platform
How the CTO2B platform supports your SOC 2 audit, who owns which controls under shared responsibility, and which evidence is available.
SOC 2 (Service Organization Control 2) is a compliance framework developed by the AICPA to ensure that service providers securely manage customer data. It focuses on five Trust Service Criteria:
| Criterion | Description |
|---|---|
| Security | Protection of systems and data against unauthorised access |
| Availability | Systems are operational and available as agreed |
| Processing Integrity | Accurate and reliable data processing |
| Confidentiality | Sensitive business or customer data is protected |
| Privacy | Personal data is handled according to privacy principles |
CTO2B is certified to ISO/IEC 27001:2022 (certificate 073AGIU085304, valid until 18 February 2029 — see the certificate on Commitment to Security & Operational Resilience) — an internationally recognised security standard that directly supports and overlaps with SOC 2 requirements. Our Infrastructure as Code (IaC) model provides inherent auditability, version-controlled changes, and automated enforcement of security controls.
How CTO2B's platform supports SOC 2
Our platform is designed to make your SOC 2 audit easier:
- Network segmentation — Workloads are logically isolated using VPCs, subnets, and security groups. All network architecture is documented, version-controlled, and consistently enforced.
- Access control — Zero-trust access with full session logging. All access is role-based, auditable, and requires multi-factor authentication.
- Encryption — Data at rest uses AES-256. Data in transit uses TLS 1.2+.
- Audit logging — Kubernetes audit logs are managed and retained by CTO2B, and are accessible for compliance reviews on request.
- Backup and disaster recovery — Automated database backups, retained per environment (see Database Backups and Point-in-Time Recovery). Recovery objectives, and the DR tests that validate them, are defined for your specific environment (see Disaster Recovery Plan and DR Testing).
- Change management — All infrastructure changes go through automated pipelines with peer review and automated testing. No direct manual changes to production environments.
Shared responsibility
SOC 2 compliance is a shared responsibility between CTO2B and your organisation. The table below outlines the division:
| Area | Owner |
|---|---|
| VPCs, security groups, and network isolation | CTO2B |
| Kubernetes control plane security | CTO2B |
| Backup and disaster recovery | CTO2B |
| Kubernetes audit logging | CTO2B |
| Identity and access control (IAM, users, roles) | Customer |
| Secure application code and deployment | Customer |
| Cloud-native audit logs and threat detection (e.g. CloudTrail, GuardDuty) | Customer |
| Cloud-native network firewall configuration | Customer |
| Monitoring and alerting | Shared |
| Networking and isolation design | Shared |
| Compliance governance and reporting | Shared |
| Data encryption at the application layer | Shared |
CTO2B secures and manages the platform layer. Your organisation remains responsible for application-level security, IAM configuration, and compliance governance for resources you own and manage directly.
Accessing compliance evidence
For your SOC 2 audit, the following evidence sources are available:
From CTO2B (on request):
- ISO/IEC 27001:2022 certificate — also published on Commitment to Security & Operational Resilience
- Architecture documentation (available under NDA)
- Infrastructure configuration records confirming network segmentation and encryption enforcement
- Change management audit records demonstrating peer-reviewed, approved changes to production
- Kubernetes audit logs and access session records
- Disaster recovery procedures and restoration test results
- Attestation letters for your auditor
From your AWS environment (customer-managed):
- AWS Config — enable predefined security rules (encryption, IAM policies, logging) to generate compliance evidence
- AWS Security Hub — enable AWS Foundational Security Best Practices to produce a downloadable SOC 2 evidence report
To request any of this evidence, raise a request or ask your Customer Success Engineer — see Getting Help for the channels.
Updated 6 days ago