Updated 2026-06-14
Mapping Trustholm artifacts to common Trust Services Criteria themes-logical access and system operations-without vendor certification claims.
Visual anchor before the full guide below.
compliance
Mapping Trustholm artifacts to common Trust Services Criteria themes-logical access and system operations-without vendor certification claims.
SOC 2 examinations evaluate whether service organization controls meet Trust Services Criteria selected for the report-commonly Security, often plus Availability or Confidentiality. Buyers frequently ask SaaS vendors for CC6 (Logical and Physical Access) and CC7 (System Operations) evidence.
Trustholm helps customers frame product artifacts against those themes; we do not claim SOC 2 Type II certification unless explicitly published elsewhere.
User and role management: Portal administrators manage users and roles with permission claims gating UI and API routes. Export screenshots and role matrices for your control binder.
Authentication: Login, MFA setup/verify, and OIDC/SAML SSO callbacks establish session authenticity. Document IdP integration and deprovisioning procedures on the customer side.
Tenant binding: JWT TenantId must match resolved tenant for portal users-reducing cross-tenant access via header manipulation. Demonstrate 403 behavior in trial for assessor walkthroughs.
Privileged action audit: Admin changes, script policy updates, and IAM events land in security audit. GET /api/audit/export supports JSON/CSV with filters-this is primary evidence for who changed what in the management plane.
Monitoring and alerting: Optional Monitoring module provides NOC dashboards and probe rollups. Pair product telemetry with your infrastructure monitoring (CPU, disk, database health, API error rates).
Incident detection: HTTP logs with tenant_id and correlation_id enrichment support triage. Security audit supports forensic review of privileged actions. Your IR runbook owns escalation and customer notification.
Change management: Script publish/approve workflows and signing policy changes generate audit trails. Correlate with change tickets in your ITSM tool.
Rate limiting: Distributed rate limiting and heavy-endpoint concurrency caps reduce abuse risk on agent and portal paths. Super Admins tune via /super-admin/rate-limits.
| Topic | Trustholm status | |-------|------------------| | Vendor SOC 2 Type II report | Not claimed on marketing site | | WORM / hash-chain audit immutability | Backlog | | Native Sentinel connector | Backlog | | Customer infra monitoring | Customer responsibility |
Assessors appreciate vendors who name gaps. Silent omission creates findings later.
Good: "Trustholm provides audit export and IAM features that customers map to CC6/CC7; vendor SOC 2 report not claimed."
Avoid: "SOC 2 compliant," implying Type II report availability, or stating certification without a report in hand.
Trustholm's product evidence map in git is the engineering source of truth; this resource summarizes buyer-facing framing.
Maintain a version-controlled folder updated each quarter: redacted audit export samples (IAM, script lifecycle), Security Center screenshots, role matrix CSV, rate-limit settings summary, and infrastructure monitoring screenshots from your cloud operator. Cross-link each artifact to control IDs in your matrix.
When auditors request changes between Type I and Type II phases, diff the folder and explain platform upgrades transparently. Sales teams should never promise certification outcomes-only artifact availability and trial reproducibility.
Download a spreadsheet template with columns for control ID, Trustholm artifact path, customer compensating control, and gap status. Populate CC6 rows first-logical access and export-then CC7 monitoring rows pairing product telemetry with infrastructure dashboards you operate.
Review with external auditor before examination kickoff. Update within five business days when trust hub evidence rows change from Gap to Shipped so customer binders stay synchronized with product reality.
Use /compliance/soc-2-evidence and /trust/audit-and-logging pages when attaching API paths to customer binders. Vendor SOC 2 Type II is not claimed.
Assign a reviewer to open trial tenant, navigate documented UI paths, and capture screenshots with timestamps. Export audit JSON for same session.
Store in immutable GRC folder. Compare results to this article quarterly.
When Shipped/Gap rows change in trust hub, re-run reproduction within ten business days. Attach limitations memo for WORM audit and Sentinel connector backlog.
Include DB operator access policy from hosting provider. Pair technical evidence with customer governance documents-policies, pentest summaries, IR runbooks.
Never substitute marketing copy for reproduced checks in front of assessors. Treat this appendix as a living runbook section owned by security engineering, not a one-time audit artifact.
Schedule annual refresh aligned with trust hub version stamps and major product releases. Link each reproduction run to a change ticket for traceability.
Distribute updated article PDFs to customer-facing teams when dateModified changes. Archive prior versions for twelve months to support assessor lookback questions.
When citing this article externally, include dateModified and pillar metadata in footnotes so readers know content freshness. Internal enablement should link pillar tags to trust hub sections for consistent customer messaging.
Add article slug to internal wiki index for sales engineering quick lookup during live questionnaire calls.
We do not claim SOC 2 Type II attestation on our marketing site. We provide technical artifacts-audit export, IAM, isolation docs-for your assessor to evaluate within your program.
GET /api/audit/export with category and datetime filters, plus users/roles UI screenshots and SSO/MFA configuration evidence.
No. Pair export with operator monitoring of databases, API hosts, and networks. CC7 expects system operations beyond application logs alone.
Many customers map similar artifacts to Annex A controls. ISO certification of the vendor is likewise not claimed-your ISMS owns attestation.
Document that rows are append-only in application flows but DBAs could mutate tables. Note shipped hash-chain verify/repair, WORM product backlog, and compensating controls (restricted DBA access, backup review).