Docs / Audit Audit Evidence Index Owner: Backend Lead / Compliance
Last Edited: March 26, 2026
Last Reviewed: March 26, 2026
How to Use This Index
Each section maps a control area to the evidence that demonstrates the control is operating. Evidence is either:
In-repo — a file, workflow, or test that can be read directly.Operational — produced by running the system (logs, screenshots, records). These must be collected and stored separately.
For a SOC 2 Type I assessment, you need to show the controls are designed and in place.
For Type II, you also need to show they operated consistently over the audit period.
1. Identity, Authentication, and Authorization
Control Evidence location Type Clerk JWT validation enforced go-backend/internal/middleware/auth.goIn-repo Strict scope mode default go-backend/cmd/api/main.go (STRICT_CLERK_SCOPES=true)In-repo All protected routes require explicit scope go-backend/internal/handler/*_handler.go (each RequireScope(...) call)In-repo Scope contract tests go-backend/internal/handler/scope_contract_test.goIn-repo API key management scope-gated go-backend/internal/handler/apikey_handler.goIn-repo Role and permission mapping docs/security/access-control-policy.mdIn-repo Clerk MFA/SSO enforcement Clerk dashboard screenshot / config export Operational Monthly access review records docs/audit/access-reviews/Operational Onboarding/offboarding checklist docs/security/access-control-policy.md (Sections 4–6)In-repo Sample terminated-user deprovision record docs/audit/access-reviews/Operational
2. Org Isolation and Data Authorization
Control Evidence location Type Org isolation architecture docs/backend/go-backend-architecture.mdIn-repo Org isolation enforced in mock repos go-backend/internal/testutil/mocks.goIn-repo Cross-org denial regression tests go-backend/internal/handler/org_isolation_test.goIn-repo Org isolation test results (CI) GitHub Actions run logs for Go Backend CI Operational Buildings explicitly public (no org_id) go-backend/internal/handler/building_handler.go (comment line 22)In-repo
3. Network Security and Transport Encryption
Control Evidence location Type TLS architecture guidance docs/ops/https-tls.mdIn-repo Backend binds to loopback only go-backend/ops/deploy/docker-compose.ymlIn-repo HSTS and security headers (frontend) frontend/public/_headersIn-repo Production CORS origins env-driven go-backend/cmd/api/main.goIn-repo Cloudflare tunnel / LB config Cloudflare dashboard screenshot Operational Certificate inventory Cloudflare / LB console export Operational Firewall / security group rules Cloud provider console export Operational
4. Secrets Management
Control Evidence location Type Secret management policy docs/security/secrets-management.mdIn-repo Centralized secrets manager (Infisical) Infisical project audit log export Operational Infisical → Render sync (backend) Infisical integration config screenshot Operational Infisical → Cloudflare Pages sync (frontend) Infisical integration config screenshot Operational .env excluded from version control.gitignoreIn-repo VITE_* documented as publicdocs/backend/go-backend-development.mdIn-repo Secret scanning configured .github/secret_scanning.ymlIn-repo Push protection enabled GitHub repo settings (screenshot) Operational Rotation log (Infisical version history) Infisical secret version history export Operational RBAC on secrets Infisical project member list / role export Operational
5. Logging, Audit, and Monitoring
Control Evidence location Type Audit middleware with DB persistence go-backend/internal/middleware/audit.goIn-repo Sensitive route coverage go-backend/internal/middleware/audit.go (sensitiveRoutes map)In-repo Sensitive field redaction go-backend/internal/middleware/audit.go (sanitizeRequestBody)In-repo Structured request logging go-backend/cmd/api/main.go (loggingMiddleware)In-repo Sentry error tracking and performance monitoring Sentry project dashboard Operational Prometheus metrics configs (local/dev only) go-backend/ops/prometheus/, go-backend/ops/alertmanager/In-repo Grafana dashboard (local/dev only) go-backend/ops/grafana/dashboards/prism-api-overview.jsonIn-repo Alert playbooks docs/ops/go-backend-runbook.md (Sections 6, 14)In-repo Sample audit log records API: GET /api/v1/audit-logs export Operational Log retention settings Render log retention / Sentry retention settings Operational Alert firing history Sentry alert history Operational
6. Change Management and SDLC
Control Evidence location Type Backend CI workflow .github/workflows/go-backend-ci.ymlIn-repo Frontend CI workflow .github/workflows/frontend-ci.ymlIn-repo CodeQL SAST .github/workflows/codeql.ymlIn-repo Dependency review on PRs .github/workflows/dependency-review.ymlIn-repo Dependabot auto-updates .github/dependabot.ymlIn-repo Swagger drift check .github/scripts/check-swagger-drift.shIn-repo Branch protection rules docs/ops/go-backend-runbook.md (Section 13)In-repo Branch protection config GitHub repo settings (screenshot or API export) Operational PR approval history GitHub pull request list Operational CI run logs GitHub Actions history Operational Deployment approval records GitHub merge history / deployment log Operational
7. Vulnerability Management
Control Evidence location Type Vulnerability management policy docs/security/vulnerability-management.mdIn-repo Dependabot alert history GitHub → Security → Dependabot Operational CodeQL finding history GitHub → Security → Code scanning Operational Vulnerability log docs/security/vulnerability-management.md (Section 6)Operational Patch SLA evidence Vulnerability log + PR timestamps Operational
8. Availability, Backup, and DR
Control Evidence location Type Backup and DR policy docs/security/backup-restore-and-dr.mdIn-repo Production runbook (deploy, rollback) docs/ops/production-runbook.mdIn-repo Restore procedure docs/security/backup-restore-and-dr.md (Section 4)In-repo Backup job records Managed DB console (Supabase / RDS) export Operational Restore drill results docs/audit/restore-drills/Operational Pre-migration snapshot records docs/ops/production-runbook.md (Section 5)Operational Uptime / availability metrics Render metrics / external uptime monitor export Operational
9. Incident Response
Control Evidence location Type Incident response policy docs/security/incident-response.mdIn-repo Severity definitions docs/security/incident-response.md (Section 1)In-repo Incident records / postmortems docs/audit/incidents/Operational Tabletop exercise notes docs/audit/incidents/tabletop-YYYY-MM-DD.mdOperational
10. Governance and Policy
Control Evidence location Type Access control policy docs/security/access-control-policy.mdIn-repo Incident response policy docs/security/incident-response.mdIn-repo Vulnerability management policy docs/security/vulnerability-management.mdIn-repo Secrets management policy docs/security/secrets-management.mdIn-repo Backup / DR policy docs/security/backup-restore-and-dr.mdIn-repo SOC 2 readiness assessment docs/audit/soc2-readiness-assessment-2026-03-26.mdIn-repo Risk backlog docs/audit/risk-backlog-2026-03-26.mdIn-repo
11. Operational Evidence Store
Operational evidence that must be collected and retained outside the repo:
docs/audit/
access-reviews/ # Monthly access review exports
incidents/ # Postmortems and tabletop exercise notes
restore-drills/ # Quarterly restore drill results
vuln-exceptions/ # Vulnerability exception approvals
ci-reports/ # Archived CI run exports (if required by auditor)
These directories should be created and populated as evidence is generated.
