MergeGuide maps SOC 2 Trust Services Criteria to code-level controls, enforces them at every layer of your development workflow, and generates audit-ready evidence artifacts automatically — from first commit to final report.
SOC 2 Type II requires organizations to demonstrate that controls were operating continuously over the audit period — typically 6 to 12 months. The problem: most evidence collection happens at audit time, not continuously.
Engineers write code. Audits happen months later. By then, evidence is reconstructed from memory, logs are incomplete, and control gaps are discovered after the fact. The audit becomes an emergency cleanup project.
MergeGuide flips the model: SOC 2 controls are enforced at code creation time. Evidence accumulates automatically throughout the development cycle. When the auditor arrives, the evidence is already prepared — complete, signed, and mapped to TSC controls.
MergeGuide templates cover all applicable Trust Services Criteria with code-level detection patterns:
VS Code diagnostics flag CC6.1 (access control), CC6.7 (encryption), and CC6.8 (injection vulnerabilities) before a line is saved. Developers see the violation and the TSC control reference inline.
When a developer asks their AI assistant to generate code, MergeGuide's MCP server injects the active SOC 2 policy set into the AI's context. The AI assistant won't generate code that violates your mapped controls.
Pre-commit hooks catch violations before they reach the remote. PR gates block merges. Each evaluation generates a signed evidence artifact mapped to the TSC controls evaluated.
SOC 2 auditors require proof that controls operated continuously. MergeGuide evidence artifacts are purpose-built for this requirement.
MergeGuide generates a complete OSCAL System Security Plan (SSP) from your evidence artifacts. The SSP maps your controls to NIST SP 800-53 and SOC 2 TSC, ready for direct submission to auditors or import into your GRC tool.
Selected examples of what MergeGuide catches. These patterns run on every commit, across all 13 supported languages.
| TSC Control | What MergeGuide Detects | Severity |
|---|---|---|
| CC6.1 | Hardcoded credentials, secrets in source code | Critical |
| CC6.1 | Overprivileged IAM roles in IaC (wildcard permissions) | High |
| CC6.2 | Disabled MFA in auth configuration | High |
| CC6.7 | Unencrypted data at rest (S3 buckets, RDS without encryption) | High |
| CC6.7 | TLS 1.0/1.1 protocol usage | High |
| CC6.8 | SQL injection patterns (unparameterized queries) | Critical |
| CC6.8 | Unsanitized user input in output rendering | High |
| CC7.1 | Unreviewed dependency additions (no lockfile update) | Medium |
| CC8.1 | Force push to protected branches in CI scripts | Medium |
See how MergeGuide integrates into your development workflow and starts accumulating audit-ready evidence from day one.