Compliance packs
Evitrus Evaluates SOC 2 Type II controls as event-presence checks over your Changes. This is not Search and not Data Export. Every verdict links back to Evidence Events. Optional production gates are separate evaluators.
Built-in SOC 2 pack
The soc2 pack ships enabled by default. It covers five Trust Services Criteria from the System Operations (CC7) family plus Change Management (CC8.1):
| Control | What we check |
|---|---|
| CC7.1 | A platform-agnostic deploy/effect event (deploy.* or release.*) exists on the change |
| CC7.2 | A successful test/CI event (test.run.passed, test.gate.passed, or legacy build.succeeded) exists |
| CC7.3 | A security or scan event (test.scan.*, security.*, or scan.*) exists |
| CC7.4 | When an incident is linked (operate.incident.* or incident.*), a response or deploy.rolled_back event exists (N/A when no incident) |
| CC8.1 | An approval event (build.change.approved, pr.approved, change.approved, or approval.*) exists |
Controls that do not apply to a change type (for example CC7.2 on an IAM-only change) are marked N/A and excluded from coverage scoring.
Enable / disable only
The built-in SOC 2 pack is not customer-editable. You can turn it on or off in product settings; you cannot change its requirements, rename controls, or delete it. To define your own rules, create a custom pack (fully editable).
What a pass does — and does not — mean
A pass means the required event types were present on that Change. It is an assertion about available evidence, not a legal opinion that the full TSC control is satisfied.
The built-in pack does not currently enforce:
- Image digest or commit linkage on deploy events
- Temporal ordering (build before release)
- Scan pass/fail or severity thresholds
- Dual human approval for production changes
- AI-assisted code human-review when an
aiactor is present
Those are roadmap enhancements for a richer rule engine. The audit lens still surfaces exceptions (failing changes) as the primary deliverable.
Collecting the right events
Most teams satisfy CC7.1–CC7.3 and CC8.1 by connecting:
- GitHub Actions — build success with image digests
- GitHub App — PR reviews, merges, code scanning
- Kubernetes exporter — deploy and config change events
Use the Ingest API for incident, approval, or scan events from other systems.