"That's not SoC 2 compliant"

Will Dollman//August 13, 2026

We’ve been sharing much astir really we work: building Amp pinch Amp, orbs, sidesplitting features, nary propulsion requests. And the astir communal guidance isn’t astir the AI workflows aliases immoderate benignant of loop chart engineering is spirit of the week. It’s this:

Wait, you don’t usage propulsion requests? You push to main? How? That’s not SOC 2 compliant.

Except it is.

Skipping propulsion requests was a deliberate prime from the first commit. It’s a large portion of how we build and why we tin vessel continuously.

So erstwhile we started moving toward SOC 2, we took that mobility consecutive to our auditors: “you request PRs for that… right?”

Controls

SOC 2 doesn’t require propulsion requests. It requires that you think astir your risks.

That’s the existent reply we came distant with. Auditors, and SOC 2 itself, are much elastic than you mightiness assume. Ours didn’t inquire america for propulsion requests; they asked what our alteration process was, and worked pinch america connected a group of controls that fresh it.

The Trust Services Criteria ne'er mention git aliases propulsion requests. What they inquire for is that changes are authorized, tested, approved, and recorded — and propulsion requests are conscionable 1 measurement of doing that.

Here are the controls we landed on:

• Restricted push access. Access to main follows business function: each technologist astatine Amp tin push, and astir of Amp is engineers. But the percent of group pinch entree matters little than being capable to explicate precisely who has it and why.
• Signed commits. Pushing already requires authentication, but perpetrate authorship is conscionable metadata. GitHub enforces verified signatures connected main, which makes the writer connected each perpetrate verifiable.
• Automated CI. Every alteration runs done the afloat validation pipeline: tests, infrastructure checks, information checks. Bad changes artifact main.
• An audit way that’s arsenic bully arsenic a PR’s. Commits nexus to the Amp threads that produced them, truthful the grounds isn’t conscionable a diff, it’s everything that led up to it. From there, CI/CD records the way from perpetrate to deployment.

None of this is exotic. But it isn’t the modular process pinch a measurement deleted, either. It’s a strategy designed connected purpose, and it gives an auditor the aforesaid point a PR workflow gives them.

And no, codification reappraisal isn’t connected the list. The criteria don’t opportunity a 2nd quality has to look astatine a diff.

Does this scale?

We’re 20 people, mostly engineers, and everyone is adjacent to the code. Being mini and high-trust is our advantage, and we aren’t going to springiness it distant for a process we don’t need. When penning codification is fast, slow process becomes what you’re really waiting on. But we’re not going to dress a 2,000-person institution should fto everyone push to main.

What does standard is think astir your risks, because consequence isn’t azygous wrong a institution either. Amp is customer-facing accumulation software, and we vessel it this way. Meanwhile, plentifulness of codification astatine bigger companies carries little consequence than that, yet each alteration goes done the aforesaid process, calibrated to the scariest strategy the institution runs.

And you don’t person to overhaul the full institution to hole that. Pick 1 strategy and ask: “What risks are our propulsion requests really managing here?” Then inquire really other you could negociate them.

The reply doesn’t person to beryllium propulsion requests.