MergeGuide maps SOC 2 Trust Services Criteria to code-level controls, enforces them at every layer of your development workflow, and generates audit-ready evidence artifacts automatically, from first commit to final report.
SOC 2 Type II requires organizations to demonstrate that controls were operating continuously over the audit period, typically 6 to 12 months. The problem: most evidence collection happens at audit time, not continuously.
Engineers write code. Audits happen months later. By then, evidence is reconstructed from memory, logs are incomplete, and control gaps are discovered after the fact. The audit becomes an emergency cleanup project.
MergeGuide flips the model: SOC 2 controls are enforced at code creation time. Evidence accumulates automatically throughout the development cycle. When the auditor arrives, the evidence is already prepared: complete, signed, and mapped to TSC controls.
MergeGuide templates cover all applicable Trust Services Criteria with code-level detection patterns:
VS Code diagnostics flag CC6.1 (access control), CC6.7 (encryption), and CC6.8 (injection vulnerabilities) before a line is saved. Developers see the violation and the TSC control reference inline.
When a developer asks their AI assistant to generate code, MergeGuide's MCP server injects the active SOC 2 policy set into the AI's context. The AI assistant won't generate code that violates your mapped controls.
Pre-commit hooks catch violations before they reach the remote. PR gates fail the status check, blocking merges once it is required. Each evaluation generates a signed evidence artifact mapped to the TSC controls evaluated.
SOC 2 auditors require proof that controls operated continuously. MergeGuide evidence artifacts are purpose-built for this requirement.
MergeGuide generates an OSCAL Component Definition capturing the code and SDLC controls it evidences, mapped to NIST SP 800-53 and SOC 2 TSC. Import it directly into your System Security Plan (SSP) or any OSCAL-compatible GRC tool.
Selected examples of what MergeGuide catches. These patterns run on every commit, across the languages your team writes in.
| TSC Control | What MergeGuide Detects | Severity |
|---|---|---|
| CC6.1 | Hardcoded credentials, secrets in source code | Critical |
| CC6.1 | Overprivileged IAM roles in IaC (wildcard permissions) | High |
| CC6.2 | Disabled MFA in auth configuration | High |
| CC6.7 | Unencrypted data at rest (S3 buckets, RDS without encryption) | High |
| CC6.7 | TLS 1.0/1.1 protocol usage | High |
| CC6.8 | SQL injection patterns (unparameterized queries) | Critical |
| CC6.8 | Unsanitized user input in output rendering | High |
| CC7.1 | Unreviewed dependency additions (no lockfile update) | Medium |
| CC8.1 | Force push to protected branches in CI scripts | Medium |
See how MergeGuide integrates into your development workflow and starts accumulating audit-ready evidence from day one.