SOC 2 readiness for open-source projects on a zero budget
SOC 2 audits are sold as a spend: a compliance vendor, a policy consultant, a surveillance stack. Small open-source projects conclude the trust signal is unaffordable and quietly skip it. This post argues the opposite โ readiness is a paper trail plus evidence, and you can assemble both for zero dollars. The P31 approach starts with an evidence collector. scripts/evidence-collect.mjs walks the repo, pulls timestamps, test runs, deploy logs, and dependency data, and emits a controls-index.json that maps every collected control to the Security TSC. When an auditor asks โshow me your access controls,โ the answer is a file, not a scavenger hunt. node scripts/evidence-collect.mjs โout controls-index.json node scripts/sbom.mjs # CycloneDX 1.5 SBOM An SBOM is the second pillar. scripts/sbom.mjs emits a CycloneDX 1.5 SBOM from the lockfiles, so the dependency surface is machine-readable and current. Between the controls index and the SBOM you can answer the two questions auditors ask first: what do you run, and how do you prove what you said? The Trust Center is the third pillar: a public surface answering the ten questions customers actually raise before procurement โ data residency, retention, encryption, access, incidents, compliance status. Ten pre-answered questions is a documentation artifact, not a SaaS product. The final pillar is signing. P31 signs artifacts with an in-house dual scheme โ ML-DSA-65 (FIPS 204) plus Ed25519 โ via the p31-crypto module, giving releases a post-quantum trust anchor without licensing a signing service. The honest caveat: this gets you ready, not certified. Formal SOC 2 attestation still needs a licensed auditor. But you enter that process with evidence, an SBOM, a Trust Center, and a signing story โ which is a far better position than a project that skipped the prep because it thought compliance required a budget. Tags: soc2, compliance, opensource, security