Where it started
The product was a developer tool: a backend, a web app, plugins for VS Code, JetBrains and Atom, and a Homebrew package. Subscriptions ran on Stripe and sign-in on Auth0. Like many young products it began on Heroku, which is the right place to start. You push code and it runs.
Products like this reach a point where buyers ask for security evidence, and a SOC 2 report is the usual answer. An auditor wants to see controls: who can reach production, how changes are reviewed and released, where the logs go, how secrets are kept. On a platform that hides most of its own workings, much of that is hard to show.
The move
The application moved to AWS, onto Amazon ECS, with RDS for the database and ElastiCache for caching. Images live in ECR, DNS in Route 53, configuration and secrets in Parameter Store, and logs in CloudWatch. CI/CD pipelines build and deploy every change, so a release is a pipeline run rather than a person at a terminal.
None of that is exotic. The value is that each piece is now something you can point at. Access is an IAM policy, a release is a pipeline log, a configuration change has a history.
What SOC 2 looks for
SOC 2 comes in two forms. Type I looks at whether the controls are designed properly at a point in time. Type II looks at whether they actually operated over a period. The product went through both, with penetration testing arranged along the way. Auditors typically want to see controls like these:
- Production access through named roles, not shared logins.
- Every change through the pipeline, so review and release leave a record.
- Logs kept centrally, where they can be searched and retained.
- Secrets out of the code and into a managed store.
The same discipline made a second edition possible: the product also ships for on-premises installs, deployed with Terraform.
If you are about to do this
Move before the audit window opens, not during it. Type II measures controls over time, and a platform migration in the middle of that period makes the evidence harder to collect. The full build is on our Work page.