# soc2 Published articles for soc2. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## How BetterTracker Replaced Its Vector Store with CockroachDB DevFeed: [How BetterTracker Replaced Its Vector Store with CockroachDB]() Original publisher: [Read original article]() Author: Yohan Shirazi Published: 2026-07-15T00:00:00Z Content type: article Language: en Sources: [Cockroach Labs]() Topics: [CockroachDB](), [AI Platform](), [Databases](), [AI search](), [Retrieval Augmented Generation (RAG)](), [Availability](), [Software as a service](), [Transactions](), [data]() Tags: [ai](), [ai-platform](), [availability](), [cockroachdb](), [compliance](), [consistency](), [data](), [database](), [rag](), [saas](), [search](), [soc2](), [transactions](), [vector-database](), [vector-search]() ### AI overview BetterTracker replaced a standalone vector database by running transactional workloads and vector search together on CockroachDB. The article describes how this supports the company's AI-powered platform while reducing infrastructure complexity and compliance risk. ### Source excerpt BetterTracker eliminated a standalone vector database by running OLTP and vector search together on CockroachDB--cutting costs, complexity, and compliance risk in one move. ## In praise of the stacked pull request DevFeed: [In praise of the stacked pull request]() Original publisher: [Read original article]() Author: hi@swizec.com (Swizec Teller) Published: 2026-02-04T00:00:00Z Content type: opinion Language: en Sources: [Swizec Teller]() Topics: [stacked pull requests](), [Code review](), [Code quality](), [Development](), [Git]() Tags: [code-quality](), [code-review](), [git](), [merge](), [pull-request](), [queue](), [soc2](), [stacked-pull-requests](), [team](), [velocity]() ### AI overview An opinion piece argues that stacked pull requests help teams work on larger or dependent changes without creating oversized, difficult-to-review pull requests. It presents small, independent, testable pull requests as units of work that can be reviewed and merged incrementally. ### Source excerpt How fast you do code review is how fast you do everything. Your PR queue is the leading indicator of team velocity. Stacked PRs can help. ## Why startups need to be secure-by-default DevFeed: [Why startups need to be secure-by-default]() Original publisher: [Read original article]() Published: 2025-12-15T00:00:00Z Content type: opinion Language: en Sources: [Chainguard: Unchained]() Topics: [Security](), [supply-chain-security](), [container images](), [chainguard]() Tags: [chainguard](), [chainguard-containers](), [chainguard-for-startups](), [chainguard-libraries](), [container-images](), [container-images-for-startups](), [secure-by-default](), [security](), [soc2](), [software-supply-chain](), [startups]() ### AI overview This commentary argues that startups should address software supply-chain security early because security reviews, SBOMs, SOC 2 requirements, vulnerability questions, and build-process scrutiny can affect sales and growth. It presents secure-by-default foundations as a way to support faster scaling. ### Source excerpt Startups can't afford to trade speed for security. Learn how Chainguard gives startups secure-by-default foundations from day one. ## Introducing JWT Signing Keys DevFeed: [Introducing JWT Signing Keys]() Original publisher: [Read original article]() Author: Stojan Dimitrovski Published: 2025-07-14T07:00:00Z Content type: release Language: en Sources: [Supabase Blog]() Topics: [JSON Web Tokens](), [Security](), [Cryptography](), [Supabase](), [API keys]() Tags: [api-keys](), [compliance](), [cryptography](), [jwt](), [latency](), [public-key](), [rotation](), [rsa](), [security](), [soc2]() ### AI overview Supabase introduces asymmetric JWT signing keys for Supabase Auth, along with new API keys to support migration and improve application security. The system uses a private key for signing and a public key for local token verification, reducing dependence on the Auth server, network latency, and shared-secret management. It supports RSA and elliptic-curve signing algorithms and safer key rotation. ### Source excerpt A new JWT signing keys system based on public key cryptography to improve your project's security and performance. ## Mastering regulatory compliance with incident.io DevFeed: [Mastering regulatory compliance with incident.io]() Original publisher: [Read original article]() Author: Chris Evans Published: 2024-10-14T07:21:00Z Content type: article Language: en Sources: [The incident.io Blog]() Topics: [incident management](), [incident](), [Incident response](), [Availability](), [Resilience](), [Security]() Tags: [audits](), [availability](), [incident](), [incident-channel](), [incident-management](), [incident-response](), [outage](), [post-mortem](), [regulatory](), [resilience](), [security](), [slack-incident](), [soc2]() ### AI overview This article explains how incident.io helps organizations manage regulatory compliance through consistent incident management, reporting, policy adherence, root cause analysis, collaboration, and audit preparation. It discusses compliance contexts including SOC2, GDPR, SEC Cyber Security Reporting guidelines, and HIPAA, emphasizing the business, legal, financial, security, availability, and customer-trust consequences of poorly managed incidents. ### Source excerpt Learn how incident.io streamlines regulatory compliance by automating incident management, enhancing collaboration, and simplifying audits for frameworks like GDPR, SOC2, and DORA. ## Turso completed SOC2 Type II compliance with zero issues DevFeed: [Turso completed SOC2 Type II compliance with zero issues]() Original publisher: [Read original article]() Author: Glauber Costa Published: 2024-07-09T00:00:00Z Content type: news Language: en Sources: [Turso Blog]() Topics: [Turso](), [Security](), [SOC](), [Data Management]() Tags: [aws](), [compliance](), [github](), [security](), [soc-2](), [soc-2-compliance](), [soc2](), [turso](), [vanta]() ### AI overview Turso announces that it completed a SOC 2 Type II compliance audit with zero issues. The article explains that the audit assessed its information-security policies, controls, and procedures, and describes how Vanta helped the small team automate compliance tasks and maintain velocity. ### Source excerpt Turso's SOC2 audit is now complete. And we passed with flying colors! ## Improving Laravel Application Security with Aikido DevFeed: [Improving Laravel Application Security with Aikido]() Original publisher: [Read original article]() Author: James Brooks Published: 2024-07-08T14:30:00Z Content type: news Language: en Sources: [Laravel Blog]() Topics: [Laravel](), [Application Security](), [Vulnerabilities](), [PHP](), [cloud security]() Tags: [application-security](), [cloud-security](), [hipaa](), [integration](), [iso-27001](), [laravel](), [php](), [scanners](), [security](), [security-vulnerabilities](), [soc2]() ### AI overview Laravel has partnered with Aikido to add security scanning for Laravel applications using Forge. The integration identifies potential vulnerabilities and security flags, surfaces findings within Forge, and combines code and cloud security scanners to help developers manage application security and compliance requirements. ### Source excerpt As your Laravel application grows, managing security objectives becomes more challenging, especially for small teams or solo developers. Today, Laravel has teamed up with Aikido to provide a seamless solution for securing your Laravel application. With Aikido, Laravel developers using Forge can effortlessly scan for and identify potential security vulnerabilities, all in less than 1 minute. ## Introducing Chainguard's Trust Center DevFeed: [Introducing Chainguard's Trust Center]() Original publisher: [Read original article]() Published: 2024-05-14T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [Security](), [supply-chain-security](), [chainguard images](), [soc 2]() Tags: [audit](), [certifications](), [chainguard](), [compliance](), [iso-27001](), [nist](), [security](), [slsa](), [soc](), [soc2](), [software-security-audit](), [software-security-best-practices](), [software-supply-chain](), [software-supply-chain-security](), [trust-center]() ### AI overview Chainguard introduces its Trust Center, a platform that centralizes security, compliance, and privacy information for users and customers. The center provides access to independent penetration-testing assessments, a SOC 2 Type 2 audit report, hardening guidance, privacy information, data-subprocessor details, and information security policies. ### Source excerpt Learn how Chainguard prioritizes security with our new Trust Center. Find info on our policies, certifications, and how we protect your software supply chain. ## An easier road to SOC 2 begins with the right approach -- and the right technology DevFeed: [An easier road to SOC 2 begins with the right approach -- and the right technology]() Original publisher: [Read original article]() Published: 2024-01-04T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [SOC](), [Security](), [Availability]() Tags: [audit](), [breach](), [compliance](), [organizational](), [security](), [security-best-practices](), [soc](), [soc-2-compliance](), [soc2](), [software-supply-chain-security](), [trust]() ### AI overview The article explains how SOC 2 certification standardizes the evaluation of an organization's security, availability, processing integrity, confidentiality, and privacy. It presents certification as a way to demonstrate trustworthy security and organizational processes while reducing the need for repeated security questionnaires. The supplied source summary states that Chainguard achieved SOC 2 certification by using its own technology to streamline security processes. ### Source excerpt Discover how Chainguard achieved SOC 2 certification by leveraging its own technology to streamline security processes. ## Into the deep: Exploring Chainguard Container Images DevFeed: [Into the deep: Exploring Chainguard Container Images]() Original publisher: [Read original article]() Published: 2023-11-29T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [chainguard images](), [container images](), [supply-chain-security](), [vulnerability management](), [Containers](), [Vulnerabilities](), [Security](), [soc2]() Tags: [base-images](), [chainguard](), [chainguard-images](), [compliance](), [container-image](), [container-images](), [pci-dss](), [sboms](), [soc2](), [software-supply-chain](), [supply-chain](), [supply-chain-security](), [vulnerabilities](), [vulnerability-management]() ### AI overview Chainguard Images provide value beyond low CVE counts by supporting software supply chain security. The article discusses rapid CVE remediation through Wolfi, enterprise remediation SLAs, compliance requirements, and the use of trusted minimal base images to reduce supply chain attack risk. ### Source excerpt Learn how Chainguard Images go beyond reducing CVE count in your software supply chain, with hardened container images, SBOMs, and more. ## Supabase is now HIPAA and SOC2 Type 2 compliant DevFeed: [Supabase is now HIPAA and SOC2 Type 2 compliant]() Original publisher: [Read original article]() Author: Inian Parameshwaran Published: 2023-08-11T07:00:00Z Content type: article Language: en Sources: [Supabase Blog]() Topics: [Supabase](), [Security]() Tags: [announcement](), [audits](), [blog-post](), [compliance](), [healthcare](), [hipaa](), [soc2]() ### AI overview Supabase announces that it is SOC2 Type 2 and HIPAA compliant. The article explains the transition from SOC2 Type 1, the evidence and process changes required for the Type 2 audit, and HIPAA's requirements for companies handling sensitive healthcare data. ### Source excerpt This documents our journey from SOC2 Type 1 to SOC2 Type2 and HIPAA compliance. You can start building healthcare apps on Supabase today. ## Achieving SOC2 Type 1 Audit Compliance DevFeed: [Achieving SOC2 Type 1 Audit Compliance]() Original publisher: [Read original article]() Author: Rory de Zoete Published: 2023-07-14T12:09:53Z Content type: article Language: en Sources: [Blog -- Neon Docs]() Topics: [Security](), [data](), [incident management](), [Disaster Recovery](), [Availability]() Tags: [article](), [availability](), [company](), [compliance](), [disaster-recovery](), [incident-management](), [recovery](), [review](), [security](), [soc2]() ### AI overview Neon describes completing its SOC2 Type 1 audit and explains SOC2's role in evaluating controls for security, availability, processing integrity, confidentiality, and privacy. The article outlines motivations including customer trust, continuous improvement, and partnership differentiation, then summarizes a roughly four-month preparation process involving gap analysis, policy and procedure development, incident management, and disaster recovery. ### Source excerpt We're excited to share that we have completed the SOC2 Type 1 audit- a significant milestone in our commitment to security. This article will cover what SOC2 is, our journey, and our plans for the future. What's SOC2? Service Organization Control 2 (SOC2) is an auditing standard... ## incident.io + Indent - on-demand system access DevFeed: [incident.io + Indent - on-demand system access]() Original publisher: [Read original article]() Author: incident.io Published: 2022-08-25T00:00:00Z Content type: article Language: en Sources: [The incident.io Blog]() Topics: [incident](), [Authorization](), [Incident response](), [incident management](), [Cloud](), [Slack](), [Web app](), [Chrome extension](), [systems]() Tags: [access-control](), [chrome-extension](), [cloud](), [incident](), [incident-channel](), [incident-management](), [incident-response](), [infrastructure](), [integration](), [outage](), [post-mortem](), [slack](), [slack-incident](), [soc2](), [web-app]() ### AI overview The article announces an integration between incident.io and Indent that provides time-bound access to cloud applications and infrastructure during incidents. On-call responders can request access from Slack, receive automatic or reviewer-based approval, configure access durations, request extensions, and track access decisions until expiration. ### Source excerpt An overview of our integration with Indent - an on-demand access control provider. ## Infrastructure Access Considerations for Financial Services DevFeed: [Infrastructure Access Considerations for Financial Services]() Original publisher: [Read original article]() Author: info@goteleport.com (Carlos Mena) Published: 2021-12-22T00:00:00Z Content type: article Language: en Sources: [Teleport]() Topics: [Cybersecurity](), [Cybercrime](), [Security Attacks](), [Business Security](), [Security](), [soc2]() Tags: [attacks](), [banking](), [breach](), [cybersecurity](), [financial-services](), [infrastructure](), [security-incidents](), [soc2]() ### AI overview This blog discusses cybersecurity threats facing Financial Services companies, including increasing attacks, data breaches, financial losses, and the time required to detect and contain incidents. It focuses on infrastructure access considerations and measures companies can take to address these risks. ### Source excerpt This blog presents data highlighting the threat that Financial Services companies face due to insecure infrastructure and what they can do about it. ## How to Achieve SOC2 Compliance for Teleport Cloud with Teleport On-Prem DevFeed: [How to Achieve SOC2 Compliance for Teleport Cloud with Teleport On-Prem]() Original publisher: [Read original article]() Author: info@goteleport.com (Travis Gary) Published: 2021-08-10T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [soc2](), [on-prem](), [Single sign-on (SSO)](), [audit](), [Security](), [ssh](), [Kubernetes](), [Databases](), [Amazon Web Services](), [Terraform](), [okta](), [web applications]() Tags: [applications](), [audit](), [availability](), [aws](), [compliance](), [databases](), [developers](), [enterprise](), [how-to](), [identity](), [incident](), [infrastructure](), [integrations](), [jira](), [kubernetes](), [okta](), [on-prem](), [pagerduty](), [platform](), [soc2]() ### AI overview This blog post explains how Teleport says it uses Teleport Cloud and Teleport On-Prem to support SOC2 compliance. It describes access controls, SSO integration, audit capabilities, approval workflows, Terraform-based change management, short-lived SSH certificates, and automated user lifecycle changes through Okta. ### Source excerpt In this blog post we illustrate how we use Teleport to achieve SOC2 compliance at Teleport ## Temporal Transparency Update #10 DevFeed: [Temporal Transparency Update #10]() Original publisher: [Read original article]() Author: Ryland Goldstein Published: 2021-02-19T04:00:00Z Content type: article Language: en Sources: [Temporal Blog]() Topics: [Apache Cassandra](), [Security](), [Authentication](), [Authorization](), [OpenID connect (OIDC)](), [Open Source](), [bug](), [upgrade](), [soc2]() Tags: [authentication](), [authorization](), [bug](), [cassandra](), [community](), [oidc](), [open-source](), [security](), [soc2](), [upgrade]() ### AI overview Temporal's tenth transparency update reports a Cassandra persistence bug affecting users before version 1.6.0 and recommends upgrading before changing Cassandra clusters. It also describes progress on security, including open-source authentication beta support for OIDC-compliant identity providers, authorization, and SOC2 preparations. ### Source excerpt Things have been very busy at Temporal over the last few months and there are some nice updates I can share. ## Teleport 5.0 Press Release DevFeed: [Teleport 5.0 Press Release]() Original publisher: [Read original article]() Author: info@goteleport.com (Teleport Team) Published: 2020-11-19T00:00:00Z Content type: release Language: en Sources: [Teleport]() Topics: [Security](), [Single sign-on (SSO)](), [audit](), [certificates](), [Kubernetes clusters](), [servers](), [Cloud](), [soc2]() Tags: [announcement](), [certificates](), [cloud](), [compliance](), [data](), [developer-productivity](), [fedramp](), [infrastructure](), [kubernetes-clusters](), [logging](), [platform](), [press-release](), [release](), [security](), [soc2](), [sso]() ### AI overview Gravitational announced its rebrand to Teleport and launched the Teleport Access Platform. The platform consolidates access controls, auditing, and compliance across infrastructure, applications, and data, including servers and Kubernetes clusters, using SSO and short-lived certificates. ### Source excerpt Teleport is the First Platform to Consolidate Access, Audit, and Compliance Across All Environments ## Seven Practices to Prepare a Startup for SOC 2 DevFeed: [Seven Practices to Prepare a Startup for SOC 2]() Original publisher: [Read original article]() Published: 2020-03-12T17:49:00Z Content type: tutorial Language: en Sources: [Latacora]() Topics: [soc2](), [Security](), [Terraform](), [CI/CD](), [Google Cloud Identity](), [okta](), [Logging](), [Provisioning](), [AWS CloudTrail](), [protected branches](), [GitHub]() Tags: [aws](), [ci-cd](), [cloudtrail](), [deployment](), [github](), [logging](), [okta](), [patches](), [protected-branches](), [security](), [soc2](), [terraform]() ### AI overview The article recommends seven practices for startups that expect large-company clients to require a SOC 2 report: centralized identity with 2FA, pull-request controls and CI/CD, centralized logging, infrastructure provisioning with Terraform or a similar tool, AWS CloudTrail and AssumeRole, device management with encryption and current patches, and software vendor risk tracking. It also recommends documenting basic policies. ### Source excerpt So, you plan to sell your startup's product to big companies one day. Congratu-dolences! Really, that's probably the only reason you should care about this article. If that's not you, go forth and live your life! We'll ask no more of your time. For the rest of you: Industry people talk about SOC2 a lot, and it's taken on a quasi-mystical status, not least because it's the product of the quasi-mystical accounting industry. But what it all boils down to is: eventually you'll run into big-company clients demanding a SOC2 report to close a sale. You know this and worry about it.