SOC 2 Certification for ChatGPT Apps: Complete Roadmap

Building enterprise-ready ChatGPT apps requires more than technical excellence—it demands verifiable security controls. SOC 2 (Service Organization Control 2) certification has become the gold standard for demonstrating trustworthiness to enterprise customers, with 83% of B2B SaaS buyers requiring SOC 2 compliance before purchase.

For ChatGPT app developers, SOC 2 certification validates that your AI-powered applications handle customer data with enterprise-grade security, availability, processing integrity, confidentiality, and privacy controls. Unlike basic security assessments, SOC 2 is an independent audit of your operational controls over a defined period (Type II reports cover 6-12 months).

This comprehensive guide provides a production-ready roadmap for achieving SOC 2 certification for ChatGPT apps, including automated evidence collection systems, control monitoring frameworks, and continuous compliance workflows. Whether you're building customer service chatbots, AI sales assistants, or intelligent automation tools, this certification roadmap will help you meet enterprise security requirements while accelerating your sales cycle.

Time to achieve SOC 2 Type II: 6-12 months from initiation to completed audit. Investment: $15,000-$50,000 for auditor fees plus internal engineering time. Business impact: 40-60% reduction in enterprise sales cycle length, 3-5x increase in enterprise deal closure rate.

Learn more about ChatGPT app security best practices and explore our enterprise security architecture guide.

Trust Service Criteria for ChatGPT Apps

SOC 2 certification evaluates five Trust Service Criteria (TSC), each containing specific control requirements that your ChatGPT app infrastructure must satisfy. Understanding these criteria is essential for scoping your certification effort and building compliant systems.

Security (CC - Common Criteria)

The Security criteria form the foundation of SOC 2 compliance, covering how you protect your ChatGPT app systems against unauthorized access:

Access Control (CC6.1-CC6.3): Multi-factor authentication for all administrative access, role-based access control (RBAC) for production systems, quarterly access reviews, automated deprovisioning when employees leave
Logical & Physical Security (CC6.4-CC6.7): Network segmentation, encryption in transit (TLS 1.3), encryption at rest (AES-256), security monitoring and intrusion detection
System Operations (CC7.1-CC7.5): Change management procedures, patch management schedules, incident response processes, backup and disaster recovery plans

For ChatGPT apps, security controls extend to your MCP server infrastructure, OpenAI API key management, and customer data processing pipelines. Demonstrate that API keys are stored in secrets management systems (AWS Secrets Manager, HashiCorp Vault), rotation occurs quarterly, and access logs are retained for 12+ months.

Availability (A1)

Availability criteria ensure your ChatGPT app maintains uptime commitments to customers:

Performance Monitoring (A1.1): Real-time monitoring of API response times, error rates, and system health with automated alerting
Capacity Planning (A1.2): Quarterly capacity reviews, auto-scaling configurations, load testing before major releases
Incident Management (A1.3): Documented incident response procedures, post-incident reviews, root cause analysis

ChatGPT apps must demonstrate 99.9% uptime SLAs with documented evidence of monitoring systems, incident escalation procedures, and capacity management. Include OpenAI API availability monitoring and fallback strategies for API outages.

Processing Integrity (PI1)

Processing integrity validates that your ChatGPT app processes data completely, accurately, and in a timely manner:

Data Quality Controls (PI1.1): Input validation, output verification, error handling, data consistency checks
System Monitoring (PI1.2): Automated quality checks, anomaly detection, audit logging
Change Controls (PI1.3): Version control, code reviews, testing procedures, rollback capabilities

For AI systems, processing integrity includes prompt injection protection, output validation to prevent hallucinations from affecting customer data, and logging of all AI-generated responses for auditability. Demonstrate that your MCP server properly validates tool inputs and handles errors gracefully.

Confidentiality (C1)

Confidentiality criteria apply when your ChatGPT app handles sensitive customer data beyond standard PII:

Data Classification (C1.1): Documented data classification scheme, labeling procedures, handling requirements
Encryption (C1.2): Encryption in transit and at rest, key management procedures
Access Restrictions (C1.3): Need-to-know access controls, data segregation between customers

ChatGPT apps often process proprietary business data, customer conversations, and API credentials. Demonstrate data isolation between customers, encryption of all stored conversations, and policies preventing employees from accessing customer data without documented business justification.

Privacy (P1-P8)

Privacy criteria align with GDPR, CCPA, and other privacy regulations:

Notice & Communication (P3.1-P3.2): Privacy policies, data processing notices, customer consent mechanisms
Choice & Consent (P4.1-P4.3): Opt-in/opt-out mechanisms, granular consent controls
Collection & Retention (P5.1-P5.2): Documented data minimization, retention schedules, automated deletion
Access & Correction (P6.1-P6.2): Customer data access portals, correction procedures, deletion requests
Disclosure to Third Parties (P7.1): Vendor management, data processing agreements, third-party security assessments

For ChatGPT apps integrating with OpenAI's API, document your data processing agreement with OpenAI, retention policies for conversation logs, and customer controls for data deletion. Implement automated deletion workflows when customers terminate their accounts.

Explore GDPR compliance for ChatGPT apps and data privacy architecture for detailed implementation guidance.

Gap Analysis and Remediation Planning

Before engaging an auditor, conduct a thorough gap analysis to identify control deficiencies and create a remediation roadmap. This self-assessment reduces audit costs and ensures you're ready for formal evaluation.

Current State Assessment

Begin by inventorying your existing controls across all five Trust Service Criteria:

Infrastructure Assessment: Document your ChatGPT app architecture including MCP servers, databases, API gateways, authentication systems, and third-party integrations. Map each component to relevant TSC controls.

Policy Review: Collect existing policies (information security, access control, incident response, change management, data retention) and compare against SOC 2 requirements. Most startups discover they have informal practices but lack documented policies—SOC 2 requires written documentation.

Control Testing: For each TSC control, evaluate whether you have: (1) a documented policy, (2) implemented technical controls, (3) evidence of operation, and (4) monitoring/alerting. Rate each control as "Implemented," "Partially Implemented," or "Not Implemented."

Evidence Gaps: Identify where you lack audit evidence. Common gaps include: access review records (quarterly reviews of who has production access), change logs (documentation of code deployments), incident reports (post-mortems with root cause analysis), and security training records.

Gap Analysis Automation

Automate your gap analysis with this TypeScript evidence collector that scans your infrastructure and identifies control gaps:

// evidence-collector.ts - Automated SOC 2 Gap Analysis
import { exec } from 'child_process';
import { promisify } from 'util';
import * as fs from 'fs/promises';
import * as path from 'path';

const execAsync = promisify(exec);

interface ControlEvidence {
  controlId: string;
  controlName: string;
  status: 'implemented' | 'partial' | 'missing';
  evidence: string[];
  gaps: string[];
  remediationPriority: 'critical' | 'high' | 'medium' | 'low';
}

interface GapAnalysisReport {
  timestamp: string;
  overallReadiness: number;
  criticalGaps: number;
  controls: ControlEvidence[];
  recommendations: string[];
}

class SOC2EvidenceCollector {
  private evidenceDir: string;
  private controls: Map<string, ControlEvidence>;

  constructor(evidenceDir = './soc2-evidence') {
    this.evidenceDir = evidenceDir;
    this.controls = new Map();
    this.initializeControls();
  }

  private initializeControls(): void {
    // Security Controls (CC6.1-CC6.7)
    this.controls.set('CC6.1', {
      controlId: 'CC6.1',
      controlName: 'Logical and Physical Access - Authorization',
      status: 'missing',
      evidence: [],
      gaps: [],
      remediationPriority: 'critical'
    });

    this.controls.set('CC6.2', {
      controlId: 'CC6.2',
      controlName: 'Multi-Factor Authentication',
      status: 'missing',
      evidence: [],
      gaps: [],
      remediationPriority: 'critical'
    });

    this.controls.set('CC6.6', {
      controlId: 'CC6.6',
      controlName: 'Encryption in Transit and at Rest',
      status: 'missing',
      evidence: [],
      gaps: [],
      remediationPriority: 'critical'
    });

    this.controls.set('CC7.2', {
      controlId: 'CC7.2',
      controlName: 'Change Management and Version Control',
      status: 'missing',
      evidence: [],
      gaps: [],
      remediationPriority: 'high'
    });

    // Availability Controls (A1.1-A1.3)
    this.controls.set('A1.2', {
      controlId: 'A1.2',
      controlName: 'System Monitoring and Alerting',
      status: 'missing',
      evidence: [],
      gaps: [],
      remediationPriority: 'high'
    });

    // Processing Integrity Controls (PI1.1-PI1.5)
    this.controls.set('PI1.4', {
      controlId: 'PI1.4',
      controlName: 'Error Detection and Correction',
      status: 'missing',
      evidence: [],
      gaps: [],
      remediationPriority: 'medium'
    });

    // Privacy Controls (P3.1-P7.1)
    this.controls.set('P5.2', {
      controlId: 'P5.2',
      controlName: 'Data Retention and Disposal',
      status: 'missing',
      evidence: [],
      gaps: [],
      remediationPriority: 'high'
    });
  }

  async collectAllEvidence(): Promise<GapAnalysisReport> {
    console.log('🔍 Starting SOC 2 gap analysis...\n');

    await this.checkAccessControls();
    await this.checkEncryption();
    await this.checkChangeManagement();
    await this.checkMonitoring();
    await this.checkDataRetention();
    await this.checkIncidentResponse();
    await this.generateReport();

    return this.buildReport();
  }

  private async checkAccessControls(): Promise<void> {
    const control = this.controls.get('CC6.1')!;
    console.log(`Checking ${control.controlName}...`);

    try {
      // Check for IAM policies
      const { stdout: awsUsers } = await execAsync('aws iam list-users 2>/dev/null || echo "AWS CLI not configured"');
      if (awsUsers.includes('Users')) {
        control.evidence.push('AWS IAM user list retrieved');
        control.status = 'partial';
      } else {
        control.gaps.push('AWS IAM not configured or accessible');
      }

      // Check for access review logs
      const reviewPath = path.join(this.evidenceDir, 'access-reviews');
      const reviewFiles = await fs.readdir(reviewPath).catch(() => []);
      if (reviewFiles.length > 0) {
        control.evidence.push(`Found ${reviewFiles.length} access review records`);
        control.status = 'implemented';
      } else {
        control.gaps.push('No quarterly access review records found');
      }

      // Check for MFA configuration
      const mfaControl = this.controls.get('CC6.2')!;
      if (awsUsers.includes('MFADevices')) {
        mfaControl.evidence.push('AWS MFA enabled');
        mfaControl.status = 'partial';
      } else {
        mfaControl.gaps.push('MFA enforcement not verified');
      }

    } catch (error) {
      control.gaps.push(`Access control check failed: ${error}`);
    }
  }

  private async checkEncryption(): Promise<void> {
    const control = this.controls.get('CC6.6')!;
    console.log(`Checking ${control.controlName}...`);

    try {
      // Check TLS configuration
      const { stdout: tlsConfig } = await execAsync('openssl s_client -connect api.makeaihq.com:443 -tls1_3 2>&1 | grep "Protocol"');
      if (tlsConfig.includes('TLSv1.3')) {
        control.evidence.push('TLS 1.3 encryption in transit verified');
        control.status = 'partial';
      } else {
        control.gaps.push('TLS 1.3 not verified on production endpoints');
      }

      // Check database encryption
      const encryptionConfigPath = path.join(this.evidenceDir, 'encryption-config.json');
      const encryptionConfig = await fs.readFile(encryptionConfigPath, 'utf-8').catch(() => null);
      if (encryptionConfig) {
        const config = JSON.parse(encryptionConfig);
        if (config.encryptionAtRest === 'AES-256') {
          control.evidence.push('AES-256 encryption at rest configured');
          control.status = 'implemented';
        }
      } else {
        control.gaps.push('No encryption-at-rest configuration documented');
      }

    } catch (error) {
      control.gaps.push(`Encryption check failed: ${error}`);
    }
  }

  private async checkChangeManagement(): Promise<void> {
    const control = this.controls.get('CC7.2')!;
    console.log(`Checking ${control.controlName}...`);

    try {
      // Check for Git repository
      const { stdout: gitLog } = await execAsync('git log --oneline --since="3 months ago" | wc -l');
      const commitCount = parseInt(gitLog.trim());

      if (commitCount > 0) {
        control.evidence.push(`${commitCount} commits in last 3 months`);
        control.status = 'partial';
      }

      // Check for change approval records
      const changeLogsPath = path.join(this.evidenceDir, 'change-logs');
      const changeLogs = await fs.readdir(changeLogsPath).catch(() => []);

      if (changeLogs.length > 0) {
        control.evidence.push(`Found ${changeLogs.length} change approval records`);
        control.status = 'implemented';
      } else {
        control.gaps.push('No documented change approval process');
        control.gaps.push('Create change request template and approval workflow');
      }

      // Check for deployment logs
      const deploymentLogsPath = path.join(this.evidenceDir, 'deployments');
      const deploymentLogs = await fs.readdir(deploymentLogsPath).catch(() => []);

      if (deploymentLogs.length === 0) {
        control.gaps.push('No deployment logs found');
      }

    } catch (error) {
      control.gaps.push(`Change management check failed: ${error}`);
    }
  }

  private async checkMonitoring(): Promise<void> {
    const control = this.controls.get('A1.2')!;
    console.log(`Checking ${control.controlName}...`);

    try {
      // Check for monitoring configuration
      const monitoringConfigPath = path.join(this.evidenceDir, 'monitoring-config.json');
      const monitoringConfig = await fs.readFile(monitoringConfigPath, 'utf-8').catch(() => null);

      if (monitoringConfig) {
        const config = JSON.parse(monitoringConfig);
        if (config.uptimeMonitoring && config.alerting) {
          control.evidence.push('Uptime monitoring and alerting configured');
          control.status = 'implemented';
        } else {
          control.gaps.push('Monitoring configuration incomplete');
        }
      } else {
        control.gaps.push('No monitoring configuration found');
        control.gaps.push('Implement CloudWatch/Datadog monitoring with alerts');
      }

      // Check for incident logs
      const incidentLogsPath = path.join(this.evidenceDir, 'incidents');
      const incidentLogs = await fs.readdir(incidentLogsPath).catch(() => []);

      if (incidentLogs.length > 0) {
        control.evidence.push(`Found ${incidentLogs.length} incident records`);
      } else {
        control.gaps.push('No incident response logs found');
      }

    } catch (error) {
      control.gaps.push(`Monitoring check failed: ${error}`);
    }
  }

  private async checkDataRetention(): Promise<void> {
    const control = this.controls.get('P5.2')!;
    console.log(`Checking ${control.controlName}...`);

    try {
      const retentionPolicyPath = path.join(this.evidenceDir, 'data-retention-policy.md');
      const retentionPolicy = await fs.readFile(retentionPolicyPath, 'utf-8').catch(() => null);

      if (retentionPolicy) {
        control.evidence.push('Data retention policy documented');

        // Check for automated deletion scripts
        const deletionScriptsPath = path.join(this.evidenceDir, 'deletion-scripts');
        const deletionScripts = await fs.readdir(deletionScriptsPath).catch(() => []);

        if (deletionScripts.length > 0) {
          control.evidence.push('Automated deletion scripts implemented');
          control.status = 'implemented';
        } else {
          control.status = 'partial';
          control.gaps.push('Automated deletion not implemented');
        }
      } else {
        control.gaps.push('No data retention policy documented');
        control.gaps.push('Create retention schedule and deletion procedures');
      }

    } catch (error) {
      control.gaps.push(`Data retention check failed: ${error}`);
    }
  }

  private async checkIncidentResponse(): Promise<void> {
    console.log('Checking incident response procedures...');

    try {
      const irPlanPath = path.join(this.evidenceDir, 'incident-response-plan.md');
      const irPlan = await fs.readFile(irPlanPath, 'utf-8').catch(() => null);

      if (!irPlan) {
        const control = this.controls.get('CC7.2')!;
        control.gaps.push('No incident response plan documented');
        control.gaps.push('Create IR plan with escalation procedures');
      }

    } catch (error) {
      console.error(`Incident response check failed: ${error}`);
    }
  }

  private async generateReport(): Promise<void> {
    const reportDir = path.join(this.evidenceDir, 'reports');
    await fs.mkdir(reportDir, { recursive: true });

    const report = this.buildReport();
    const reportPath = path.join(reportDir, `gap-analysis-${new Date().toISOString().split('T')[0]}.json`);

    await fs.writeFile(reportPath, JSON.stringify(report, null, 2));
    console.log(`\n✅ Gap analysis report saved to: ${reportPath}`);
  }

  private buildReport(): GapAnalysisReport {
    const controls = Array.from(this.controls.values());
    const implementedCount = controls.filter(c => c.status === 'implemented').length;
    const totalControls = controls.length;
    const criticalGaps = controls.filter(c =>
      c.status !== 'implemented' && c.remediationPriority === 'critical'
    ).length;

    const recommendations: string[] = [];

    if (criticalGaps > 0) {
      recommendations.push('Address all critical gaps before engaging auditor');
    }

    if (implementedCount / totalControls < 0.7) {
      recommendations.push('Complete at least 70% of controls before Type I audit');
    }

    recommendations.push('Implement automated evidence collection for all controls');
    recommendations.push('Document all policies and procedures in writing');
    recommendations.push('Conduct quarterly access reviews and retain records');

    return {
      timestamp: new Date().toISOString(),
      overallReadiness: Math.round((implementedCount / totalControls) * 100),
      criticalGaps,
      controls,
      recommendations
    };
  }
}

// Usage
async function main() {
  const collector = new SOC2EvidenceCollector('./soc2-evidence');
  const report = await collector.collectAllEvidence();

  console.log('\n📊 Gap Analysis Summary');
  console.log('='.repeat(50));
  console.log(`Overall Readiness: ${report.overallReadiness}%`);
  console.log(`Critical Gaps: ${report.criticalGaps}`);
  console.log(`\n🔧 Top Recommendations:`);
  report.recommendations.forEach((rec, i) => {
    console.log(`${i + 1}. ${rec}`);
  });
}

main().catch(console.error);

This evidence collector automates the gap analysis process, scanning your infrastructure for SOC 2 controls and identifying missing evidence. Run it quarterly to track remediation progress.

Remediation Roadmap

Based on your gap analysis, create a prioritized remediation plan:

Phase 1 (Months 1-2): Critical Controls - Implement MFA for all production access, deploy encryption at rest, establish quarterly access review process, document information security policy.

Phase 2 (Months 3-4): High-Priority Controls - Implement change management workflow, deploy monitoring and alerting, create incident response plan, establish vendor management process.

Phase 3 (Months 5-6): Medium-Priority Controls - Implement automated backup and recovery testing, create business continuity plan, establish security awareness training, deploy vulnerability scanning.

Phase 4 (Months 7-9): Evidence Collection - Implement automated evidence collection systems, conduct internal control testing, prepare audit artifacts, perform readiness assessment.

Phase 5 (Months 10-12): Audit Execution - Engage auditor, complete Type I audit, remediate findings, begin Type II observation period (6-12 months).

Learn more about security compliance automation and enterprise security roadmaps.

Automated Evidence Collection

SOC 2 audits require extensive documentation proving your controls operated effectively throughout the observation period. Manual evidence collection is time-consuming and error-prone—automate it with these production-ready systems.

Continuous Evidence Collection

Deploy automated collectors that capture audit evidence in real-time:

// control-monitor.ts - Real-time SOC 2 Control Monitoring
import { Firestore } from '@google-cloud/firestore';
import { CloudWatch } from '@aws-sdk/client-cloudwatch';
import { S3 } from '@aws-sdk/client-s3';
import * as crypto from 'crypto';

interface ControlEvent {
  controlId: string;
  eventType: 'access' | 'change' | 'incident' | 'backup' | 'review';
  timestamp: string;
  actor: string;
  details: Record<string, any>;
  evidenceHash: string;
}

interface AuditTrail {
  eventId: string;
  controlId: string;
  eventType: string;
  timestamp: string;
  actor: string;
  resource: string;
  action: string;
  result: 'success' | 'failure';
  ipAddress: string;
  evidenceUrl: string;
}

class ControlMonitor {
  private firestore: Firestore;
  private cloudwatch: CloudWatch;
  private s3: S3;
  private evidenceBucket: string;

  constructor(projectId: string, evidenceBucket: string) {
    this.firestore = new Firestore({ projectId });
    this.cloudwatch = new CloudWatch({ region: 'us-east-1' });
    this.s3 = new S3({ region: 'us-east-1' });
    this.evidenceBucket = evidenceBucket;
  }

  // CC6.1: Track all administrative access
  async logAccessEvent(
    userId: string,
    resource: string,
    action: string,
    result: 'success' | 'failure',
    metadata: Record<string, any> = {}
  ): Promise<void> {
    const event: ControlEvent = {
      controlId: 'CC6.1',
      eventType: 'access',
      timestamp: new Date().toISOString(),
      actor: userId,
      details: {
        resource,
        action,
        result,
        ipAddress: metadata.ipAddress,
        userAgent: metadata.userAgent,
        mfaVerified: metadata.mfaVerified
      },
      evidenceHash: ''
    };

    event.evidenceHash = this.hashEvidence(event);

    // Store in Firestore
    await this.firestore.collection('audit_trails').add(event);

    // Archive to S3 for long-term retention
    await this.archiveEvidence('access-logs', event);

    // Send to CloudWatch for alerting
    await this.cloudwatch.putMetricData({
      Namespace: 'SOC2/AccessControl',
      MetricData: [{
        MetricName: 'AccessEvents',
        Value: 1,
        Timestamp: new Date(),
        Dimensions: [
          { Name: 'Result', Value: result },
          { Name: 'Resource', Value: resource }
        ]
      }]
    });

    console.log(`✅ Access event logged: ${userId} → ${resource} (${result})`);
  }

  // CC7.2: Track all production changes
  async logChangeEvent(
    changeId: string,
    changeType: 'code' | 'config' | 'infrastructure',
    approver: string,
    implementer: string,
    description: string,
    metadata: Record<string, any> = {}
  ): Promise<void> {
    const event: ControlEvent = {
      controlId: 'CC7.2',
      eventType: 'change',
      timestamp: new Date().toISOString(),
      actor: implementer,
      details: {
        changeId,
        changeType,
        approver,
        implementer,
        description,
        gitCommit: metadata.gitCommit,
        deploymentId: metadata.deploymentId,
        rollbackPlan: metadata.rollbackPlan,
        testingEvidence: metadata.testingEvidence
      },
      evidenceHash: ''
    };

    event.evidenceHash = this.hashEvidence(event);

    await this.firestore.collection('change_logs').add(event);
    await this.archiveEvidence('change-logs', event);

    console.log(`✅ Change event logged: ${changeId} by ${implementer}`);
  }

  // CC7.3: Track security incidents
  async logIncidentEvent(
    incidentId: string,
    severity: 'critical' | 'high' | 'medium' | 'low',
    description: string,
    detectedBy: string,
    respondedBy: string,
    resolution: string,
    metadata: Record<string, any> = {}
  ): Promise<void> {
    const event: ControlEvent = {
      controlId: 'CC7.3',
      eventType: 'incident',
      timestamp: new Date().toISOString(),
      actor: respondedBy,
      details: {
        incidentId,
        severity,
        description,
        detectedBy,
        respondedBy,
        detectionTime: metadata.detectionTime,
        resolutionTime: metadata.resolutionTime,
        rootCause: metadata.rootCause,
        resolution,
        preventiveMeasures: metadata.preventiveMeasures
      },
      evidenceHash: ''
    };

    event.evidenceHash = this.hashEvidence(event);

    await this.firestore.collection('incidents').add(event);
    await this.archiveEvidence('incidents', event);

    // Alert on critical incidents
    if (severity === 'critical') {
      await this.cloudwatch.putMetricData({
        Namespace: 'SOC2/Incidents',
        MetricData: [{
          MetricName: 'CriticalIncidents',
          Value: 1,
          Timestamp: new Date()
        }]
      });
    }

    console.log(`✅ Incident logged: ${incidentId} (${severity})`);
  }

  // A1.2: Track system availability
  async logAvailabilityMetrics(
    service: string,
    uptime: number,
    responseTime: number,
    errorRate: number
  ): Promise<void> {
    const event: ControlEvent = {
      controlId: 'A1.2',
      eventType: 'review',
      timestamp: new Date().toISOString(),
      actor: 'system',
      details: {
        service,
        uptime,
        responseTime,
        errorRate,
        slaTarget: 99.9,
        slaAchieved: uptime >= 99.9
      },
      evidenceHash: ''
    };

    event.evidenceHash = this.hashEvidence(event);

    await this.firestore.collection('availability_metrics').add(event);
    await this.archiveEvidence('availability', event);

    console.log(`✅ Availability metrics logged: ${service} (${uptime}% uptime)`);
  }

  // CC6.1: Quarterly access reviews
  async logAccessReview(
    reviewerId: string,
    usersReviewed: string[],
    accessRevoked: string[],
    findings: string[]
  ): Promise<void> {
    const event: ControlEvent = {
      controlId: 'CC6.1',
      eventType: 'review',
      timestamp: new Date().toISOString(),
      actor: reviewerId,
      details: {
        reviewType: 'access_review',
        usersReviewed: usersReviewed.length,
        accessRevoked: accessRevoked.length,
        revokedUsers: accessRevoked,
        findings,
        nextReviewDate: this.calculateNextReviewDate()
      },
      evidenceHash: ''
    };

    event.evidenceHash = this.hashEvidence(event);

    await this.firestore.collection('access_reviews').add(event);
    await this.archiveEvidence('access-reviews', event);

    console.log(`✅ Access review logged: ${usersReviewed.length} users reviewed`);
  }

  // P5.2: Track data retention and disposal
  async logDataDeletion(
    dataType: string,
    recordCount: number,
    retentionPeriod: string,
    deletedBy: string
  ): Promise<void> {
    const event: ControlEvent = {
      controlId: 'P5.2',
      eventType: 'review',
      timestamp: new Date().toISOString(),
      actor: deletedBy,
      details: {
        dataType,
        recordCount,
        retentionPeriod,
        deletionMethod: 'secure_erasure',
        verificationHash: crypto.randomBytes(32).toString('hex')
      },
      evidenceHash: ''
    };

    event.evidenceHash = this.hashEvidence(event);

    await this.firestore.collection('data_deletion_logs').add(event);
    await this.archiveEvidence('data-deletion', event);

    console.log(`✅ Data deletion logged: ${recordCount} ${dataType} records`);
  }

  private hashEvidence(event: ControlEvent): string {
    const eventString = JSON.stringify({
      controlId: event.controlId,
      eventType: event.eventType,
      timestamp: event.timestamp,
      actor: event.actor,
      details: event.details
    });

    return crypto
      .createHash('sha256')
      .update(eventString)
      .digest('hex');
  }

  private async archiveEvidence(
    category: string,
    event: ControlEvent
  ): Promise<void> {
    const date = new Date();
    const key = `${category}/${date.getFullYear()}/${date.getMonth() + 1}/${event.eventType}-${Date.now()}.json`;

    await this.s3.putObject({
      Bucket: this.evidenceBucket,
      Key: key,
      Body: JSON.stringify(event, null, 2),
      ContentType: 'application/json',
      ServerSideEncryption: 'AES256',
      Metadata: {
        controlId: event.controlId,
        eventType: event.eventType,
        timestamp: event.timestamp
      }
    });
  }

  private calculateNextReviewDate(): string {
    const nextReview = new Date();
    nextReview.setMonth(nextReview.getMonth() + 3);
    return nextReview.toISOString();
  }

  // Generate audit report
  async generateAuditReport(
    startDate: Date,
    endDate: Date,
    controlIds: string[]
  ): Promise<any> {
    const report: Record<string, any> = {
      period: {
        start: startDate.toISOString(),
        end: endDate.toISOString()
      },
      controls: {}
    };

    for (const controlId of controlIds) {
      const events = await this.firestore
        .collection('audit_trails')
        .where('controlId', '==', controlId)
        .where('timestamp', '>=', startDate.toISOString())
        .where('timestamp', '<=', endDate.toISOString())
        .get();

      report.controls[controlId] = {
        totalEvents: events.size,
        events: events.docs.map(doc => doc.data())
      };
    }

    return report;
  }
}

// Usage Example
async function main() {
  const monitor = new ControlMonitor('your-project-id', 'your-evidence-bucket');

  // Log access event
  await monitor.logAccessEvent(
    'admin@example.com',
    'production-database',
    'read',
    'success',
    {
      ipAddress: '203.0.113.45',
      userAgent: 'Mozilla/5.0',
      mfaVerified: true
    }
  );

  // Log change event
  await monitor.logChangeEvent(
    'CHG-2026-001',
    'code',
    'engineering-manager@example.com',
    'developer@example.com',
    'Deploy ChatGPT app v2.1.0',
    {
      gitCommit: 'abc123def456',
      deploymentId: 'deploy-20260125-001',
      rollbackPlan: 'Rollback to v2.0.9 if errors > 1%',
      testingEvidence: 'https://example.com/test-report-001.pdf'
    }
  );

  // Log quarterly access review
  await monitor.logAccessReview(
    'security-team@example.com',
    ['user1@example.com', 'user2@example.com', 'contractor@example.com'],
    ['contractor@example.com'],
    ['Contractor access revoked - contract ended', 'All other access appropriate']
  );
}

main().catch(console.error);

Deploy this control monitor to automatically capture SOC 2 evidence across your infrastructure. Integrate it into authentication systems, deployment pipelines, and operational workflows.

Compliance Dashboard

Build a real-time compliance dashboard to visualize control status and evidence collection:

// compliance-dashboard.tsx - SOC 2 Compliance Dashboard
import React, { useEffect, useState } from 'react';
import { BarChart, Bar, LineChart, Line, PieChart, Pie, Cell, XAxis, YAxis, CartesianGrid, Tooltip, Legend, ResponsiveContainer } from 'recharts';

interface ControlStatus {
  controlId: string;
  controlName: string;
  status: 'compliant' | 'partial' | 'non-compliant';
  evidenceCount: number;
  lastTested: string;
  nextReview: string;
}

interface ComplianceMetrics {
  overallCompliance: number;
  controlsByStatus: { name: string; value: number }[];
  evidenceTrend: { month: string; collected: number }[];
  criticalFindings: number;
}

const ComplianceDashboard: React.FC = () => {
  const [metrics, setMetrics] = useState<ComplianceMetrics | null>(null);
  const [controls, setControls] = useState<ControlStatus[]>([]);

  useEffect(() => {
    fetchComplianceData();
  }, []);

  const fetchComplianceData = async () => {
    // Fetch from your API
    const response = await fetch('/api/compliance/dashboard');
    const data = await response.json();

    setMetrics(data.metrics);
    setControls(data.controls);
  };

  const COLORS = {
    compliant: '#10b981',
    partial: '#f59e0b',
    'non-compliant': '#ef4444'
  };

  if (!metrics) {
    return <div>Loading compliance data...</div>;
  }

  return (
    <div className="compliance-dashboard">
      <header className="dashboard-header">
        <h1>SOC 2 Compliance Dashboard</h1>
        <div className="overall-score">
          <span className="score-label">Overall Compliance:</span>
          <span className="score-value" style={{
            color: metrics.overallCompliance >= 90 ? '#10b981' :
                   metrics.overallCompliance >= 70 ? '#f59e0b' : '#ef4444'
          }}>
            {metrics.overallCompliance}%
          </span>
        </div>
      </header>

      <div className="metrics-grid">
        <div className="metric-card">
          <h3>Controls by Status</h3>
          <ResponsiveContainer width="100%" height={300}>
            <PieChart>
              <Pie
                data={metrics.controlsByStatus}
                cx="50%"
                cy="50%"
                labelLine={false}
                label={({ name, value }) => `${name}: ${value}`}
                outerRadius={80}
                fill="#8884d8"
                dataKey="value"
              >
                {metrics.controlsByStatus.map((entry, index) => (
                  <Cell key={`cell-${index}`} fill={COLORS[entry.name as keyof typeof COLORS]} />
                ))}
              </Pie>
              <Tooltip />
            </PieChart>
          </ResponsiveContainer>
        </div>

        <div className="metric-card">
          <h3>Evidence Collection Trend</h3>
          <ResponsiveContainer width="100%" height={300}>
            <LineChart data={metrics.evidenceTrend}>
              <CartesianGrid strokeDasharray="3 3" />
              <XAxis dataKey="month" />
              <YAxis />
              <Tooltip />
              <Legend />
              <Line type="monotone" dataKey="collected" stroke="#3b82f6" strokeWidth={2} />
            </LineChart>
          </ResponsiveContainer>
        </div>

        <div className="metric-card alert-card">
          <h3>Critical Findings</h3>
          <div className="alert-count">{metrics.criticalFindings}</div>
          <p>Require immediate attention</p>
        </div>
      </div>

      <div className="controls-table">
        <h2>Control Status</h2>
        <table>
          <thead>
            <tr>
              <th>Control ID</th>
              <th>Control Name</th>
              <th>Status</th>
              <th>Evidence Count</th>
              <th>Last Tested</th>
              <th>Next Review</th>
              <th>Actions</th>
            </tr>
          </thead>
          <tbody>
            {controls.map(control => (
              <tr key={control.controlId}>
                <td>{control.controlId}</td>
                <td>{control.controlName}</td>
                <td>
                  <span className={`status-badge status-${control.status}`}>
                    {control.status}
                  </span>
                </td>
                <td>{control.evidenceCount}</td>
                <td>{new Date(control.lastTested).toLocaleDateString()}</td>
                <td>{new Date(control.nextReview).toLocaleDateString()}</td>
                <td>
                  <button onClick={() => window.location.href = `/compliance/controls/${control.controlId}`}>
                    View Details
                  </button>
                </td>
              </tr>
            ))}
          </tbody>
        </table>
      </div>

      <style jsx>{`
        .compliance-dashboard {
          padding: 2rem;
          background: #f9fafb;
          min-height: 100vh;
        }

        .dashboard-header {
          display: flex;
          justify-content: space-between;
          align-items: center;
          margin-bottom: 2rem;
          padding: 1.5rem;
          background: white;
          border-radius: 8px;
          box-shadow: 0 1px 3px rgba(0,0,0,0.1);
        }

        .overall-score {
          display: flex;
          flex-direction: column;
          align-items: flex-end;
        }

        .score-label {
          font-size: 0.875rem;
          color: #6b7280;
          margin-bottom: 0.25rem;
        }

        .score-value {
          font-size: 2.5rem;
          font-weight: bold;
        }

        .metrics-grid {
          display: grid;
          grid-template-columns: repeat(auto-fit, minmax(300px, 1fr));
          gap: 1.5rem;
          margin-bottom: 2rem;
        }

        .metric-card {
          background: white;
          padding: 1.5rem;
          border-radius: 8px;
          box-shadow: 0 1px 3px rgba(0,0,0,0.1);
        }

        .metric-card h3 {
          margin-top: 0;
          margin-bottom: 1rem;
          color: #111827;
        }

        .alert-card {
          display: flex;
          flex-direction: column;
          justify-content: center;
          align-items: center;
          text-align: center;
        }

        .alert-count {
          font-size: 3rem;
          font-weight: bold;
          color: #ef4444;
          margin: 1rem 0;
        }

        .controls-table {
          background: white;
          padding: 1.5rem;
          border-radius: 8px;
          box-shadow: 0 1px 3px rgba(0,0,0,0.1);
        }

        .controls-table h2 {
          margin-top: 0;
          margin-bottom: 1rem;
        }

        table {
          width: 100%;
          border-collapse: collapse;
        }

        th {
          text-align: left;
          padding: 0.75rem;
          background: #f3f4f6;
          font-weight: 600;
          color: #374151;
          border-bottom: 2px solid #e5e7eb;
        }

        td {
          padding: 0.75rem;
          border-bottom: 1px solid #e5e7eb;
        }

        .status-badge {
          display: inline-block;
          padding: 0.25rem 0.75rem;
          border-radius: 9999px;
          font-size: 0.875rem;
          font-weight: 500;
        }

        .status-compliant {
          background: #d1fae5;
          color: #065f46;
        }

        .status-partial {
          background: #fef3c7;
          color: #92400e;
        }

        .status-non-compliant {
          background: #fee2e2;
          color: #991b1b;
        }

        button {
          padding: 0.5rem 1rem;
          background: #3b82f6;
          color: white;
          border: none;
          border-radius: 6px;
          cursor: pointer;
          font-size: 0.875rem;
        }

        button:hover {
          background: #2563eb;
        }
      `}</style>
    </div>
  );
};

export default ComplianceDashboard;

This dashboard provides real-time visibility into SOC 2 compliance status, helping you track remediation progress and prepare for audits.

Explore automated compliance testing and audit automation tools for additional evidence collection strategies.

Audit Preparation and Execution

Once you've implemented controls and collected 3-6 months of evidence, prepare for the formal audit by selecting an auditor, preparing documentation, and conducting internal testing.

Selecting a SOC 2 Auditor

Choose an auditor based on these criteria:

Industry Experience: Select auditors with SaaS and AI/ML experience who understand ChatGPT app architectures. Ask for client references in similar industries.

Turnaround Time: Typical Type I audits take 4-8 weeks; Type II audits take 8-12 weeks. Clarify timelines upfront to avoid delays.

Report Quality: Request sample reports to evaluate clarity and detail. Well-written reports enhance customer confidence.

Pricing: Type I audits cost $10,000-$25,000; Type II audits cost $25,000-$50,000+ depending on scope. Get fixed-price quotes to avoid budget overruns.

Popular SOC 2 auditors: A-LIGN, Schellman, Prescient Assurance, Sensiba San Filippo, Moss Adams.

Audit Trail Logger

Implement comprehensive audit logging for all system activities:

// audit-trail-logger.ts - Comprehensive Audit Logging
import { Firestore } from '@google-cloud/firestore';
import { Logger } from 'winston';
import * as crypto from 'crypto';

interface AuditLog {
  eventId: string;
  timestamp: string;
  eventType: string;
  actor: {
    userId: string;
    email: string;
    role: string;
    ipAddress: string;
  };
  resource: {
    type: string;
    id: string;
    name: string;
  };
  action: string;
  result: 'success' | 'failure';
  changes?: {
    before: Record<string, any>;
    after: Record<string, any>;
  };
  metadata: Record<string, any>;
  hash: string;
}

class AuditTrailLogger {
  private firestore: Firestore;
  private logger: Logger;

  constructor(projectId: string, logger: Logger) {
    this.firestore = new Firestore({ projectId });
    this.logger = logger;
  }

  async logEvent(
    eventType: string,
    actor: { userId: string; email: string; role: string; ipAddress: string },
    resource: { type: string; id: string; name: string },
    action: string,
    result: 'success' | 'failure',
    changes?: { before: Record<string, any>; after: Record<string, any> },
    metadata: Record<string, any> = {}
  ): Promise<void> {
    const eventId = crypto.randomUUID();
    const timestamp = new Date().toISOString();

    const auditLog: AuditLog = {
      eventId,
      timestamp,
      eventType,
      actor,
      resource,
      action,
      result,
      changes,
      metadata,
      hash: ''
    };

    // Generate tamper-proof hash
    auditLog.hash = this.generateHash(auditLog);

    // Store in Firestore
    await this.firestore
      .collection('audit_logs')
      .doc(eventId)
      .set(auditLog);

    // Log to Winston
    this.logger.info('Audit event logged', { auditLog });

    console.log(`✅ Audit log created: ${eventId}`);
  }

  private generateHash(log: AuditLog): string {
    const logString = JSON.stringify({
      eventId: log.eventId,
      timestamp: log.timestamp,
      eventType: log.eventType,
      actor: log.actor,
      resource: log.resource,
      action: log.action,
      result: log.result,
      changes: log.changes
    });

    return crypto
      .createHash('sha256')
      .update(logString)
      .digest('hex');
  }

  async verifyLogIntegrity(eventId: string): Promise<boolean> {
    const doc = await this.firestore
      .collection('audit_logs')
      .doc(eventId)
      .get();

    if (!doc.exists) {
      return false;
    }

    const log = doc.data() as AuditLog;
    const storedHash = log.hash;

    // Temporarily remove hash for recalculation
    log.hash = '';
    const recalculatedHash = this.generateHash(log);

    return storedHash === recalculatedHash;
  }

  async queryLogs(
    filters: {
      eventType?: string;
      actorId?: string;
      resourceType?: string;
      startDate?: Date;
      endDate?: Date;
    }
  ): Promise<AuditLog[]> {
    let query = this.firestore.collection('audit_logs') as any;

    if (filters.eventType) {
      query = query.where('eventType', '==', filters.eventType);
    }

    if (filters.actorId) {
      query = query.where('actor.userId', '==', filters.actorId);
    }

    if (filters.resourceType) {
      query = query.where('resource.type', '==', filters.resourceType);
    }

    if (filters.startDate) {
      query = query.where('timestamp', '>=', filters.startDate.toISOString());
    }

    if (filters.endDate) {
      query = query.where('timestamp', '<=', filters.endDate.toISOString());
    }

    const snapshot = await query.get();
    return snapshot.docs.map((doc: any) => doc.data() as AuditLog);
  }
}

// Usage
async function main() {
  const logger = require('winston').createLogger({
    transports: [new (require('winston').transports.Console)()]
  });

  const auditLogger = new AuditTrailLogger('your-project-id', logger);

  // Log user access event
  await auditLogger.logEvent(
    'user_access',
    {
      userId: 'user123',
      email: 'admin@example.com',
      role: 'admin',
      ipAddress: '203.0.113.45'
    },
    {
      type: 'database',
      id: 'prod-db-001',
      name: 'Production Database'
    },
    'read',
    'success',
    undefined,
    { mfaVerified: true }
  );

  // Verify log integrity
  const isValid = await auditLogger.verifyLogIntegrity('event-id-123');
  console.log(`Log integrity: ${isValid ? 'VALID' : 'TAMPERED'}`);
}

main().catch(console.error);

Access Review System

Automate quarterly access reviews to satisfy CC6.1 requirements:

// access-review-system.ts - Automated Access Reviews
import { Firestore } from '@google-cloud/firestore';
import * as nodemailer from 'nodemailer';

interface AccessRight {
  userId: string;
  email: string;
  role: string;
  resources: string[];
  grantedDate: string;
  grantedBy: string;
  lastReviewed?: string;
}

interface ReviewDecision {
  userId: string;
  decision: 'retain' | 'revoke' | 'modify';
  justification: string;
  reviewedBy: string;
  reviewDate: string;
}

class AccessReviewSystem {
  private firestore: Firestore;
  private mailer: nodemailer.Transporter;

  constructor(projectId: string) {
    this.firestore = new Firestore({ projectId });
    this.mailer = nodemailer.createTransport({
      host: process.env.SMTP_HOST,
      port: 587,
      secure: false,
      auth: {
        user: process.env.SMTP_USER,
        pass: process.env.SMTP_PASS
      }
    });
  }

  async initiateQuarterlyReview(reviewerId: string): Promise<void> {
    console.log('🔍 Initiating quarterly access review...');

    const accessRights = await this.getAllAccessRights();
    const reviewId = `review-${Date.now()}`;

    await this.firestore.collection('access_reviews').doc(reviewId).set({
      reviewId,
      status: 'in_progress',
      initiatedBy: reviewerId,
      initiatedDate: new Date().toISOString(),
      totalUsers: accessRights.length,
      reviewedUsers: 0,
      accessRevoked: []
    });

    // Send review notification
    await this.sendReviewNotification(reviewerId, accessRights.length);

    console.log(`✅ Review initiated: ${reviewId} (${accessRights.length} users)`);
  }

  async getAllAccessRights(): Promise<AccessRight[]> {
    const snapshot = await this.firestore.collection('access_rights').get();
    return snapshot.docs.map(doc => doc.data() as AccessRight);
  }

  async reviewAccess(
    reviewId: string,
    userId: string,
    decision: 'retain' | 'revoke' | 'modify',
    justification: string,
    reviewedBy: string
  ): Promise<void> {
    const reviewDecision: ReviewDecision = {
      userId,
      decision,
      justification,
      reviewedBy,
      reviewDate: new Date().toISOString()
    };

    await this.firestore
      .collection('access_reviews')
      .doc(reviewId)
      .collection('decisions')
      .doc(userId)
      .set(reviewDecision);

    if (decision === 'revoke') {
      await this.revokeAccess(userId);
    }

    console.log(`✅ Access reviewed: ${userId} (${decision})`);
  }

  private async revokeAccess(userId: string): Promise<void> {
    // Implement actual access revocation
    await this.firestore
      .collection('access_rights')
      .doc(userId)
      .update({ status: 'revoked', revokedDate: new Date().toISOString() });

    console.log(`🔒 Access revoked: ${userId}`);
  }

  private async sendReviewNotification(reviewerId: string, userCount: number): Promise<void> {
    await this.mailer.sendMail({
      from: 'compliance@example.com',
      to: reviewerId,
      subject: 'Quarterly Access Review Required',
      html: `
        <h2>Quarterly Access Review</h2>
        <p>Please review access rights for ${userCount} users.</p>
        <p><a href="https://example.com/compliance/access-review">Start Review</a></p>
      `
    });
  }
}

Change Management Tracker

Track all production changes with approval workflows:

// change-management-tracker.ts - Change Management System
import { Firestore } from '@google-cloud/firestore';

interface ChangeRequest {
  changeId: string;
  title: string;
  description: string;
  changeType: 'code' | 'config' | 'infrastructure';
  priority: 'critical' | 'high' | 'medium' | 'low';
  requestedBy: string;
  requestDate: string;
  approvedBy?: string;
  approvalDate?: string;
  implementedBy?: string;
  implementationDate?: string;
  status: 'pending' | 'approved' | 'implemented' | 'rejected';
  rollbackPlan: string;
  testingEvidence: string;
}

class ChangeManagementTracker {
  private firestore: Firestore;

  constructor(projectId: string) {
    this.firestore = new Firestore({ projectId });
  }

  async createChangeRequest(
    title: string,
    description: string,
    changeType: 'code' | 'config' | 'infrastructure',
    requestedBy: string,
    rollbackPlan: string
  ): Promise<string> {
    const changeId = `CHG-${Date.now()}`;

    const changeRequest: ChangeRequest = {
      changeId,
      title,
      description,
      changeType,
      priority: 'medium',
      requestedBy,
      requestDate: new Date().toISOString(),
      status: 'pending',
      rollbackPlan,
      testingEvidence: ''
    };

    await this.firestore
      .collection('change_requests')
      .doc(changeId)
      .set(changeRequest);

    console.log(`✅ Change request created: ${changeId}`);
    return changeId;
  }

  async approveChange(changeId: string, approver: string): Promise<void> {
    await this.firestore
      .collection('change_requests')
      .doc(changeId)
      .update({
        status: 'approved',
        approvedBy: approver,
        approvalDate: new Date().toISOString()
      });

    console.log(`✅ Change approved: ${changeId}`);
  }

  async implementChange(
    changeId: string,
    implementer: string,
    testingEvidence: string
  ): Promise<void> {
    await this.firestore
      .collection('change_requests')
      .doc(changeId)
      .update({
        status: 'implemented',
        implementedBy: implementer,
        implementationDate: new Date().toISOString(),
        testingEvidence
      });

    console.log(`✅ Change implemented: ${changeId}`);
  }
}

Explore change management automation and deployment approval workflows.

Continuous Compliance Monitoring

SOC 2 compliance isn't a one-time achievement—it requires continuous monitoring, testing, and improvement. Implement automated systems to maintain compliance between annual audits.

Vulnerability Scanner

Automate vulnerability scanning to satisfy CC7.1 (system monitoring):

#!/bin/bash
# vulnerability-scanner.sh - Automated Vulnerability Scanning

# Configuration
SCAN_DATE=$(date +%Y-%m-%d)
EVIDENCE_DIR="./soc2-evidence/vulnerability-scans"
REPORT_FILE="$EVIDENCE_DIR/scan-$SCAN_DATE.json"

mkdir -p "$EVIDENCE_DIR"

echo "🔍 Starting vulnerability scan: $SCAN_DATE"

# Scan dependencies for known vulnerabilities
echo "Scanning npm dependencies..."
npm audit --json > "$EVIDENCE_DIR/npm-audit-$SCAN_DATE.json"

# Scan Docker images
echo "Scanning Docker images..."
docker scan makeaihq-dev:latest --json > "$EVIDENCE_DIR/docker-scan-$SCAN_DATE.json" 2>/dev/null || echo "Docker scan not available"

# Scan infrastructure with Trivy
echo "Scanning infrastructure..."
trivy config . --format json > "$EVIDENCE_DIR/trivy-scan-$SCAN_DATE.json" 2>/dev/null || echo "Trivy not installed"

# Check SSL/TLS configuration
echo "Checking SSL/TLS..."
echo | openssl s_client -connect api.makeaihq.com:443 -servername api.makeaihq.com 2>/dev/null | \
  openssl x509 -noout -dates -subject -issuer > "$EVIDENCE_DIR/ssl-check-$SCAN_DATE.txt"

# Generate summary report
cat > "$REPORT_FILE" <<EOF
{
  "scanDate": "$SCAN_DATE",
  "scansPerformed": [
    "npm-audit",
    "docker-scan",
    "trivy-config-scan",
    "ssl-tls-check"
  ],
  "evidenceFiles": [
    "npm-audit-$SCAN_DATE.json",
    "docker-scan-$SCAN_DATE.json",
    "trivy-scan-$SCAN_DATE.json",
    "ssl-check-$SCAN_DATE.txt"
  ],
  "nextScanDate": "$(date -d "+1 week" +%Y-%m-%d)"
}
EOF

echo "✅ Vulnerability scan complete: $REPORT_FILE"

# Check for critical vulnerabilities
CRITICAL_COUNT=$(jq '.metadata.vulnerabilities.critical // 0' "$EVIDENCE_DIR/npm-audit-$SCAN_DATE.json" 2>/dev/null || echo 0)

if [ "$CRITICAL_COUNT" -gt 0 ]; then
  echo "⚠️  ALERT: $CRITICAL_COUNT critical vulnerabilities found!"
  # Send alert (implement your alerting logic)
fi

Incident Response Automation

Automate incident logging and response workflows:

// incident-response.ts - Automated Incident Response
import { Firestore } from '@google-cloud/firestore';
import * as nodemailer from 'nodemailer';

interface Incident {
  incidentId: string;
  severity: 'critical' | 'high' | 'medium' | 'low';
  title: string;
  description: string;
  detectedBy: string;
  detectedAt: string;
  status: 'open' | 'investigating' | 'resolved' | 'closed';
  assignedTo?: string;
  rootCause?: string;
  resolution?: string;
  resolvedAt?: string;
}

class IncidentResponseSystem {
  private firestore: Firestore;
  private mailer: nodemailer.Transporter;

  constructor(projectId: string) {
    this.firestore = new Firestore({ projectId });
    this.mailer = nodemailer.createTransport({
      host: process.env.SMTP_HOST,
      port: 587,
      auth: {
        user: process.env.SMTP_USER,
        pass: process.env.SMTP_PASS
      }
    });
  }

  async reportIncident(
    severity: 'critical' | 'high' | 'medium' | 'low',
    title: string,
    description: string,
    detectedBy: string
  ): Promise<string> {
    const incidentId = `INC-${Date.now()}`;

    const incident: Incident = {
      incidentId,
      severity,
      title,
      description,
      detectedBy,
      detectedAt: new Date().toISOString(),
      status: 'open'
    };

    await this.firestore
      .collection('incidents')
      .doc(incidentId)
      .set(incident);

    // Auto-assign critical incidents
    if (severity === 'critical') {
      await this.escalateIncident(incidentId);
    }

    await this.sendIncidentNotification(incident);

    console.log(`🚨 Incident reported: ${incidentId} (${severity})`);
    return incidentId;
  }

  private async escalateIncident(incidentId: string): Promise<void> {
    const oncallEngineer = await this.getOncallEngineer();

    await this.firestore
      .collection('incidents')
      .doc(incidentId)
      .update({
        assignedTo: oncallEngineer,
        status: 'investigating'
      });

    console.log(`📞 Incident escalated to: ${oncallEngineer}`);
  }

  private async getOncallEngineer(): Promise<string> {
    // Implement on-call rotation logic
    return 'oncall@example.com';
  }

  private async sendIncidentNotification(incident: Incident): Promise<void> {
    const recipients = incident.severity === 'critical'
      ? ['oncall@example.com', 'security-team@example.com']
      : ['security-team@example.com'];

    await this.mailer.sendMail({
      from: 'incidents@example.com',
      to: recipients.join(','),
      subject: `[${incident.severity.toUpperCase()}] ${incident.title}`,
      html: `
        <h2>Security Incident: ${incident.incidentId}</h2>
        <p><strong>Severity:</strong> ${incident.severity}</p>
        <p><strong>Description:</strong> ${incident.description}</p>
        <p><strong>Detected by:</strong> ${incident.detectedBy}</p>
        <p><a href="https://example.com/incidents/${incident.incidentId}">View Incident</a></p>
      `
    });
  }

  async resolveIncident(
    incidentId: string,
    rootCause: string,
    resolution: string,
    resolvedBy: string
  ): Promise<void> {
    await this.firestore
      .collection('incidents')
      .doc(incidentId)
      .update({
        status: 'resolved',
        rootCause,
        resolution,
        resolvedAt: new Date().toISOString()
      });

    console.log(`✅ Incident resolved: ${incidentId}`);
  }
}

Policy Enforcer

Automate policy enforcement across your infrastructure:

// policy-enforcer.ts - Automated Policy Enforcement
import { Firestore } from '@google-cloud/firestore';

interface PolicyViolation {
  violationId: string;
  policyId: string;
  policyName: string;
  resource: string;
  severity: 'critical' | 'high' | 'medium' | 'low';
  detectedAt: string;
  remediated: boolean;
}

class PolicyEnforcer {
  private firestore: Firestore;

  constructor(projectId: string) {
    this.firestore = new Firestore({ projectId });
  }

  async enforcePasswordPolicy(userId: string, password: string): Promise<boolean> {
    const violations: string[] = [];

    if (password.length < 12) violations.push('Password must be at least 12 characters');
    if (!/[A-Z]/.test(password)) violations.push('Password must contain uppercase letter');
    if (!/[a-z]/.test(password)) violations.push('Password must contain lowercase letter');
    if (!/[0-9]/.test(password)) violations.push('Password must contain number');
    if (!/[^A-Za-z0-9]/.test(password)) violations.push('Password must contain special character');

    if (violations.length > 0) {
      await this.logViolation('password-policy', userId, violations);
      return false;
    }

    return true;
  }

  private async logViolation(
    policyId: string,
    resource: string,
    violations: string[]
  ): Promise<void> {
    const violation: PolicyViolation = {
      violationId: `VIO-${Date.now()}`,
      policyId,
      policyName: 'Password Policy',
      resource,
      severity: 'medium',
      detectedAt: new Date().toISOString(),
      remediated: false
    };

    await this.firestore
      .collection('policy_violations')
      .add(violation);
  }
}

Compliance Reporter

Generate automated compliance reports for stakeholders:

// compliance-reporter.ts - Automated Compliance Reporting
import { Firestore } from '@google-cloud/firestore';
import * as PDFDocument from 'pdfkit';
import * as fs from 'fs';

class ComplianceReporter {
  private firestore: Firestore;

  constructor(projectId: string) {
    this.firestore = new Firestore({ projectId });
  }

  async generateMonthlyReport(month: string, year: number): Promise<string> {
    const reportPath = `./reports/compliance-${year}-${month}.pdf`;
    const doc = new PDFDocument();

    doc.pipe(fs.createWriteStream(reportPath));

    // Header
    doc.fontSize(20).text('SOC 2 Compliance Report', { align: 'center' });
    doc.fontSize(12).text(`Period: ${month} ${year}`, { align: 'center' });
    doc.moveDown();

    // Metrics
    const metrics = await this.getComplianceMetrics(month, year);

    doc.fontSize(14).text('Compliance Metrics');
    doc.fontSize(10).text(`Overall Compliance: ${metrics.overallCompliance}%`);
    doc.text(`Evidence Collected: ${metrics.evidenceCount}`);
    doc.text(`Policy Violations: ${metrics.violations}`);
    doc.text(`Incidents: ${metrics.incidents}`);

    doc.end();

    console.log(`✅ Compliance report generated: ${reportPath}`);
    return reportPath;
  }

  private async getComplianceMetrics(month: string, year: number) {
    // Implement metric collection
    return {
      overallCompliance: 95,
      evidenceCount: 1247,
      violations: 3,
      incidents: 1
    };
  }
}

Learn more about continuous compliance automation and SOC 2 monitoring best practices.

Conclusion: Building Trust Through Certification

SOC 2 certification transforms your ChatGPT app from a technical demo into an enterprise-ready platform. By implementing the controls, evidence collection systems, and monitoring frameworks outlined in this guide, you'll achieve compliance while building defensible security practices that scale with your business.

The investment in SOC 2—typically $15,000-$50,000 in auditor fees plus 3-6 months of engineering time—delivers measurable ROI through reduced sales cycles (40-60% faster), higher enterprise deal closure rates (3-5x improvement), and premium pricing power (10-30% higher willingness to pay).

Start with gap analysis, implement critical controls first, automate evidence collection from day one, and engage an auditor when you have 3-6 months of operational evidence. Your customers will reward you with trust, contracts, and long-term partnerships.

Ready to build SOC 2-compliant ChatGPT apps without the complexity? MakeAIHQ provides enterprise-grade security controls, automated compliance monitoring, and SOC 2-ready infrastructure out of the box. Start your free trial and deploy audit-ready ChatGPT apps in 48 hours.

Related Resources:

Enterprise Security Architecture for ChatGPT Apps
GDPR Compliance for ChatGPT Apps
HIPAA Compliance for Healthcare Chatbots
PCI DSS Compliance for Payment Chatbots
ISO 27001 Certification Guide
Security Monitoring and Alerting

External Resources: