SOC 2 Evidence and Exports
The evaluation register, immutable append-only evidence records, integrity verification, and Vanta-shaped CSV/PDF exports for CC1.4 and CC1.5.
Why It Matters
For CC1.4 (“the entity demonstrates a commitment to attract, develop, and retain competent individuals”) and CC1.5 (“the entity holds individuals accountable”), a Type II auditor wants three artifacts: a written policy with a defined cadence, a completion tracker covering 100% of employees they can sample names from, and a completed, dated review record for each sampled name: reviewer, period, assessment against documented role expectations. They also check what teams hope they won’t: records backfilled the week before the audit betray themselves through batch-created timestamps.
Kit records the register and per-person evaluation snapshots when a cycle is finalized; your team defines the review policy separately. The application blocks later edits and deletion of evidence records. Their creation dates show when the snapshots were saved, but do not independently verify the truth of a review or when the work described took place.
The Evaluation Register
Every cycle has a register at Register on the cycle page, one row per participant, in the seven columns Vanta and auditors expect:
| Column | Source |
|---|---|
| Employee | Name, frozen at finalization |
| Frozen at finalization | |
| Reviewer(s) | Every assigned reviewer, with roles |
| Review Cycle | Cycle name |
| Rating | The manager review’s overall rating |
| Review date | The evidence record’s mint timestamp |
| Status | Completed / Pending |
While the cycle is active, the register is a live completion tracker: a participant shows Completed only when all of their assigned reviews are submitted, with a “12 of 15 complete” progress line for chasing stragglers. Once the cycle is finalized, every value comes from the frozen snapshots, the facts as finalized, never live rows.
Immutable Evaluation Records
Finalizing a cycle mints one evaluation record per participant in a single transaction; a half-minted register cannot exist, and a double-finalize is refused rather than duplicating evidence. Each record snapshots everything an auditor samples, decoupled from live data:
- Reviewee name and email; every reviewer with their role
- Cycle name, cadence, and review period; role expectations as documented for this participant
- The template name, version, and the full question set in force
- Every submitted review: answers, ratings, summary, submission timestamp, and its AI-assisted flag
- Whether the self-review was completed, and the manager’s overall rating
Records are append-only: once written, updates are refused at the model layer and deletes are aborted; there is no edit path, not even for admins. Snapshots are encrypted at rest. If an employee offboards, their evidence record survives: a terminated employee’s review is exactly what an auditor samples.
Warning
Immutability cuts both ways: a typo in a submitted review is frozen forever at finalization. Use the finalize confirmation screen as your last quality gate; it tells you exactly how many participants’ evidence is about to be frozen.
Integrity Verification
A nightly check looks for participants missing an evidence record in a finalized cycle, records on cycles that were never finalized, and snapshotted submission dates later than record creation. Violations go to Kit monitoring. These checks detect specific consistency errors; they do not verify the truth of review content.
Exports
From the register, three artifacts:
| Artifact | Button | Contents |
|---|---|---|
| Vanta-shaped CSV | Export CSV | The seven register columns, one row per employee; upload it to Vanta/Drata or hand it to the auditor directly |
| Register PDF | Export PDF | The same table, branded, dated, human-readable |
| Evaluation document | Document (per row) | One person’s full evidence: role expectations, every review with answers and ratings, the AI-assisted flag |
Exports generate asynchronously and appear on the register page when ready; download links are time-limited, and archives expire after 7 days. Regenerate on demand; the source records never expire. Every CSV cell is sanitized against formula injection, so the file is safe to open in Excel or Sheets. Status values in the CSV are stable English literals (“Completed”/“Pending”) regardless of your UI language, since it’s an auditor-facing spec.
How an Auditor Samples It
Compare completed cycles with the cadence in your policy. Before handing over the CSV, check its participants: the export has one row per participant, so 100% coverage requires adding every employee in scope. If the auditor samples five names, open each Document PDF for the reviewers, period, criteria, review content, and dates. These records support the assessment of competence and accountability; the audit determines the scope and sufficiency of the evidence.
Quick Checklist
- Write a one-page review policy stating your cadence. Kit is the evidence, the policy is yours
- Ensure every employee is a participant before finalizing (auditors sample the full population)
- Finalize on schedule; the mint timestamp is the evidence date
- Export the register CSV each cycle into your compliance folder or GRC tool
- Spot-check one evaluation document per cycle for role expectations and named reviewers
Next Steps
- Review Cycles: the finalize gate that mints these records
- AI Agent and MCP Tools: pull the register programmatically at audit time