SOC 2 vulnerability management, evidence you can hand an auditor
SOC 2 asks you to show that you find, prioritize and remediate vulnerabilities, and that the record is trustworthy. CVEasy AI produces that evidence from a tamper-evident signed ledger, maps its own controls to the Trust Services Criteria, and keeps your findings on your own hardware.
Evidence · Integrity · On-box
SOC 2 wants vulnerability management you can prove.
The relevant Trust Services Criteria are about process and evidence, not a single scan.
A SOC 2 examination looks for a repeatable process: vulnerabilities are identified, risk-ranked, remediated within a defined window, and the whole thing is logged in a way that cannot be quietly edited after the fact. The common criteria that touch vulnerability management include change management, monitoring and the integrity of your audit records.
The hard part for most teams is not scanning. It is producing credible, tamper-evident evidence that the process ran, and doing so without exporting sensitive findings to yet another cloud.
From findings to auditor-ready evidence.
CVEasy is built so the evidence is a by-product of normal use.
- Tamper-evident record: AI, agent, configuration and remediation actions are written to an append-only, Ed25519-signed, SHA-256 hash-chained ledger whose edits and deletes are refused at the database
- Offline verifier: a dependency-free checker confirms the chain and signatures, so the evidence stands on its own
- Prioritized remediation: TRIS™ 3 scoring shows risk-ranking was applied, not a flat severity dump
- Validation: built-in attack simulation records what was proven reachable and what a re-run showed fixed
- Data residency: findings and the AI stay on your Mac, which simplifies the data-handling questions a SOC 2 review raises
- Questionnaire ready: a CAIQ-lite / SIG-lite answer sheet is available under NDA during procurement (request the security pack)
We map our controls to SOC 2. We do not claim a certificate we do not hold.
Honesty is part of the pitch.
CVEasy ships a live Security & Audit posture that maps its own controls to SOC 2, ISO 27001 and NIST CSF, marking each control active (live-verified), attested (enforced in code) or degraded. It is a self-assessment backed by running state, never a certificate or an audit opinion.
On our own status: CVEasy does not hold a SOC 2 report, and no auditor has examined our controls. We will not describe CVEasy as SOC 2 compliant, certified or audited unless an independent report exists.
The combination that matters for a SOC 2 reviewer is the signed, hash-chained ledger plus the offline verifier: it lets you demonstrate record integrity directly. Ask for the CAIQ-lite / SIG-lite sheet and the written policy set during procurement. See the Trust Center.
Questions, answered.
The questions practitioners actually ask.
Is CVEasy SOC 2 certified?
No. CVEasy does not hold a SOC 2 report and is not SOC 2 certified or audited. CVEasy helps you produce your own SOC 2 vulnerability management evidence, and it maps its own controls to the Trust Services Criteria as a self-assessment, never as a certificate.
What evidence can I hand my auditor?
A tamper-evident, Ed25519-signed and SHA-256 hash-chained ledger of AI, agent, configuration and remediation actions, verifiable with a dependency-free offline checker, plus TRIS™ risk-ranking and attack-validation records that show the process ran.
Does using CVEasy send my findings to the cloud?
No. Findings, asset inventory and the AI stay on your own Apple Silicon Mac. That on-box model simplifies several data-handling questions a SOC 2 review raises.
Can CVEasy answer a security questionnaire?
Yes. A CAIQ-lite / SIG-lite answer sheet and a written policy set are available under NDA during procurement, grounded in controls enforced in code and an honest in-progress status where that is the truth. Request the security pack.
Make SOC 2 evidence a by-product, not a project.
Signed, verifiable, on your own hardware.
Mac-native · local-first · your data never leaves the box