Teams and your SOC 2 audit

Short Leash Pro for Teams gives a company controls over how its developers' Short Leash is used, and a record of them held. This page lists each control, the SOC 2 Trust Services Criteria auditors usually map it to, and where to get the evidence. It's for your own audit: Short Leash itself isn't SOC 2 certified, and an auditor decides what evidence they accept.

Everything here is in your account, on a team with Short Leash Pro for Teams. Owners, admins and auditors, a read-only team role, see the evidence pages; only owners and admins change anything.

Who can reach the team

CC6.1, CC6.2, CC6.3: logical access, provisioning and least privilege.

Roles. Owners, admins, members and auditors each do only what their role allows, and the Team page lists who has which. An auditor reads and exports, and changes nothing.
Two-factor authentication. Owners can require it under Team › Signing in; until someone turns it on, they can't open the team's pages.
Single sign-on. People with your company's email sign in through your identity provider, such as Okta, Microsoft Entra or Google Workspace, with its own MFA. Setting it up has the steps. Owners can require it, and keep a password and two-factor way in for when the provider is down.
Sessions. Each person sees where they're signed in, under Security, and can sign out everywhere else.

Evidence: the audit log, filtered to Team and people and Sign-ins and security. It shows every role change, invitation, sign-in, failed sign-in and two-factor change.

Joining and leaving

CC6.2, CC6.5: provisioning and removing access.

Directory sync (SCIM). Connect your directory under Single sign-on. People join the team when they're added in it, with the role their groups give, and leave it when they're deactivated.
Offboarding. When someone leaves or is removed, their seat is taken back, so their key stops working, and the computers it's on are freed. Each step is recorded.

Evidence: the audit log, filtered to Team and people and Seats, keys and computers: who was removed, when, by whom or by your directory, and their seat and computers going with them.

What every computer may do

CC6.6, CC6.8, CC8.1: managing access from outside, against unauthorized software, and changes.

Policies set what Short Leash may do on the team's computers: sharing, features, coding assistants, runtime versions, services, the lowest Short Leash. They're fetched signed every 15 minutes. See Team policies.
Change management. Every save is a new version, with who changed which rule from what to what. Report only tries a change on everyone's computers before it's enforced.

Evidence: the audit log, filtered to Policy, and the policy's history.

That it held, day by day

CC7.1, CC7.2: monitoring.

Computers shows each computer on the team's keys as current, breaking a rule, behind the policy, on a Short Leash too old for it, not checking in, or freed, with a day-by-day history.
Where they stood on a day. The Computers export gives every computer's state at the end of any day, in CSV or JSON. It's the evidence that the policy held on the dates your auditor samples.
Drift digests. Owners, admins and auditors are emailed what has drifted: computers not checking in, behind or breaking a rule, and people without required two-factor. They come on Monday mornings or every morning, as the team chooses on Computers.

The audit log itself

CC4.1, CC7.2: monitoring activities and evaluating events.

What it records. Every change to the team, its people, seats, keys, computers, policy and billing, each person's sign-ins and security changes, and every export. Each entry has who, what, when (UTC), the IP address and browser, and what changed.
Tamper-evident. Entries can't be changed. Each is chained by hash to the one before, so a changed or removed entry shows, and the exports carry the hashes so it can be checked outside the website.
Retention. Entries and computers' history are kept for two years, including after a person or the team is deleted.

Evidence: Audit log › Export, CSV or JSON, for any dates and kinds.

What it doesn't cover

A team's policy holds on the team's own computers, but enforcement there is cooperative. Someone with administrator rights on their computer, or a terminal, can get around Short Leash's own controls; keep computers on the team's keys with device management and treat the rest as part of your endpoint controls. The website's own infrastructure is run by Laravel Cloud and Cloudflare under their own compliance programs.