SOC 2 Readiness

Generate a SOC 2 Type 1 evidence pack from your ɳSelf Cloud instance.

The compliance plugin produces a SOC 2 Type 1 evidence pack for tenants who serve enterprise clients. The pack gives a third-party auditor everything they need to start an attestation without manual data collection.

Requires: Enterprise license, NSELF_COMPLIANCE_SOC2=true

What is in the pack

The exported ZIP covers all five Trust Service Criteria:

File	TSC	Contents
`CC6-user-provisioning-log.csv`	CC6	Access grant and revocation events
`CC6-access-review.csv`	CC6	Quarterly access review records
`CC7-change-management.csv`	CC7	Config, plugin, schema, user changes
`CC9-vendor-list.csv`	CC9	Vendor registry with risk tiers
`A1-availability-metrics.csv`	A1	Service health events by day
`policies/*.md`	All TSCs	Five rendered policy documents
`manifest.sha256`	—	SHA-256 hash of every file

Generating a pack

nself compliance soc2 evidence --from 2026-01-01 --to 2026-06-30

Or via the API:

curl -X POST https://api.your-instance.com/api/v1/compliance/soc2/evidence \
  -H "X-Nself-License-Tier: business" \
  -H "Content-Type: application/json" \
  -d '{"from":"2026-01-01","to":"2026-06-30"}' \
  --output soc2-evidence.zip

Verify integrity:

unzip soc2-evidence.zip manifest.sha256
sha256sum -c manifest.sha256

Access reviews (CC6)

Schedule and complete quarterly access reviews:

# Open a review
curl -X POST .../api/v1/compliance/access-reviews \
  -d '{"period_start":"2026-01-01","period_end":"2026-03-31"}'

# Close it with findings
curl -X PATCH .../api/v1/compliance/access-reviews/:id \
  -d '{"status":"complete","findings":{"accounts_reviewed":42,"access_removed":3}}'

Change log (CC7)

Record every infrastructure change before it is applied:

curl -X POST .../api/v1/compliance/change-log \
  -d '{
    "change_type": "schema",
    "description": "Added np_change_log index for tenant_id",
    "ticket_ref": "NSELF-456",
    "approved_by": "<admin-uuid>"
  }'

Change types: config plugin user schema

Policy documents

Five policy templates are rendered and included in every evidence pack. Customize them before submitting to your auditor:

Access Control Policy (CC6)
Change Management Policy (CC7)
Incident Response Policy (CC7, A1)
Vendor Management Policy (CC9)
Business Continuity Policy (A1)

Feature flags

Variable	Required	Effect
`nself`	Yes	Enables SOC 2 dashboard
`nself`	Yes	Enables evidence download
`nself`	Enterprise	Continuous monitoring
`nself`	No	MinIO bucket for pack storage
`nself`	No	Presigned URL TTL (seconds, default 86400)

Database tables

Table	Purpose
`np_change_log`	Change management records (CC7)
`np_access_reviews`	Access review records (CC6)
`np_vendor_registry`	Vendor inventory (CC9)

Tables are created automatically when the compliance plugin starts.

Permissions

Role	Access
`compliance:read`	View controls, reviews, change log
`compliance:export`	Generate and download evidence packs
`compliance:admin`	Manage vendor registry, approve reviews

All endpoints return 401 without an Enterprise license.