SOC 2 readiness for open-source projects on a zero budget

SOC 2 audits are sold as a spend: a compliance vendor, a policy consultant, a
surveillance stack. Small open-source projects conclude the trust signal is
unaffordable and quietly skip it. This post argues the opposite — readiness is
a paper trail plus evidence, and you can assemble both for zero dollars.

The P31 approach starts with an evidence collector. scripts/evidence-collect.mjs
walks the repo, pulls timestamps, test runs, deploy logs, and dependency data,
and emits a controls-index.json that maps every collected control to the
Security TSC. When an auditor asks "show me your access controls," the answer
is a file, not a scavenger hunt.

node scripts/evidence-collect.mjs --out controls-index.json
node scripts/sbom.mjs            # CycloneDX 1.5 SBOM

An SBOM is the second pillar. scripts/sbom.mjs emits a CycloneDX 1.5 SBOM
from the lockfiles, so the dependency surface is machine-readable and current.
Between the controls index and the SBOM you can answer the two questions
auditors ask first: what do you run, and how do you prove what you said?

The Trust Center is the third pillar: a public surface answering the ten
questions customers actually raise before procurement — data residency,
retention, encryption, access, incidents, compliance status. Ten pre-answered
questions is a documentation artifact, not a SaaS product.

The final pillar is signing. P31 signs artifacts with an in-house dual scheme —
ML-DSA-65 (FIPS 204) plus Ed25519 — via the p31-crypto module, giving releases
a post-quantum trust anchor without licensing a signing service.

The honest caveat: this gets you ready, not certified. Formal SOC 2
attestation still needs a licensed auditor. But you enter that process with
evidence, an SBOM, a Trust Center, and a signing story — which is a far better
position than a project that skipped the prep because it thought compliance
required a budget.

• Tags: soc2, compliance, opensource, security