SOC 2 Evidence and Exports
The evaluation register, immutable append-only evidence records, integrity verification, and Vanta-shaped CSV/PDF exports for CC1.4 and CC1.5.
Why It Matters
For CC1.4 (“the entity demonstrates a commitment to attract, develop, and retain competent individuals”) and CC1.5 (“the entity holds individuals accountable”), a Type II auditor wants three artifacts: a written policy with a defined cadence, a completion tracker covering 100% of employees they can sample names from, and a completed, dated review record for each sampled name — reviewer, period, assessment against documented role expectations. They also check what teams hope they won’t: records backfilled the week before the audit betray themselves through batch-created timestamps.
Kit produces all three as a side effect of finalizing a cycle. The register is the tracker, each evaluation record is the per-person artifact, and because records are append-only with tamper-evident timestamps minted at finalization time, the “was this backfilled?” question answers itself in your favor.
The Evaluation Register
Every cycle has a register at Register on the cycle page — one row per participant, in the seven columns Vanta and auditors expect:
| Column | Source |
|---|---|
| Employee | Name, frozen at finalization |
| Frozen at finalization | |
| Reviewer(s) | Every assigned reviewer, with roles |
| Review Cycle | Cycle name |
| Rating | The manager review’s overall rating |
| Review date | The evidence record’s mint timestamp |
| Status | Completed / Pending |
While the cycle is active, the register is a live completion tracker — a participant shows Completed only when all of their assigned reviews are submitted, with a “12 of 15 complete” progress line for chasing stragglers. Once the cycle is finalized, every value comes from the frozen snapshots — the facts as finalized, never live rows.
Immutable Evaluation Records
Finalizing a cycle mints one evaluation record per participant in a single transaction — a half-minted register cannot exist, and a double-finalize is refused rather than duplicating evidence. Each record snapshots everything an auditor samples, decoupled from live data:
- Reviewee name and email; every reviewer with their role
- Cycle name, cadence, and review period; role expectations as documented for this participant
- The template name, version, and the full question set in force
- Every submitted review: answers, ratings, summary, submission timestamp, and its AI-assisted flag
- Whether the self-review was completed, and the manager’s overall rating
Records are append-only: once written, updates are refused at the model layer and deletes are aborted — there is no edit path, not even for admins. Snapshots are encrypted at rest. If an employee offboards, their evidence record survives — a terminated employee’s review is exactly what an auditor samples.
Warning
Immutability cuts both ways: a typo in a submitted review is frozen forever at finalization. Use the finalize confirmation screen as your last quality gate — it tells you exactly how many participants’ evidence is about to be frozen.
Integrity Verification
A nightly integrity sweep walks every cycle’s evidence chain and asserts three invariants: a finalized cycle has exactly one record per participant (nothing missing), no record exists on a never-finalized cycle (nothing minted out of band), and every snapshotted review submission precedes its record’s mint time (no post-hoc insertions). Violations surface to Kit’s monitoring — the point is that “the chain is tamper-free” is checked continuously, not asserted once a year.
Exports
From the register, three artifacts:
| Artifact | Button | Contents |
|---|---|---|
| Vanta-shaped CSV | Export CSV | The seven register columns, one row per employee — upload it to Vanta/Drata or hand it to the auditor directly |
| Register PDF | Export PDF | The same table, branded, dated, human-readable |
| Evaluation document | Document (per row) | One person’s full evidence: role expectations, every review with answers and ratings, the AI-assisted flag |
Exports generate asynchronously and appear on the register page when ready; download links are time-limited, and archives expire after 7 days — regenerate on demand, the source records never expire. Every CSV cell is sanitized against formula injection, so the file is safe to open in Excel or Sheets. Status values in the CSV are stable English literals (“Completed”/“Pending”) regardless of your UI language — it’s an auditor-facing spec.
How an Auditor Samples It
The walkthrough is short. Policy states cadence → the cycles list shows a cycle per period. Auditor requests the population → you export the register CSV, one row per employee, 100% coverage. Auditor samples five names → you open each Document PDF: reviewer names, review period, assessment against documented role expectations, dated completion. Auditor asks how you know records weren’t fabricated → append-only records, mint timestamps distributed at finalization (not batch-created pre-audit), and a nightly integrity check. That maps to CC1.4 (competence assessed against documented expectations, on a defined cadence) and CC1.5 (accountability: named reviewers, individual ratings, dated records per person).
Quick Checklist
- Write a one-page review policy stating your cadence — Kit is the evidence, the policy is yours
- Ensure every employee is a participant before finalizing (auditors sample the full population)
- Finalize on schedule — the mint timestamp is the evidence date
- Export the register CSV each cycle into your compliance folder or GRC tool
- Spot-check one evaluation document per cycle for role expectations and named reviewers
Next Steps
- Review Cycles — the finalize gate that mints these records
- AI Agent and MCP Tools — pull the register programmatically at audit time