Verification methodology

How ProofLane collects evidence, what each check proves, what it cannot prove, and how you can re-verify the evidence yourself. This page is generated from the same check definitions the product runs — if a check changes, this page changes.

1. How evidence is collected

Collectors query your connected systems (GitHub, Google Workspace, AWS in v1) on a cadence and store one evidence record per check per run. Three rules are enforced in code, not promised in copy:

Failure is honest. If an API is unreachable, the check records ERROR evidence with the failure detail. Nothing is guessed, and nothing is silently marked as passing.
Fixtures are labeled. Evidence collected in mock/demo mode carries artifact_source: fixture on every record and can never be mistaken for live data.
No evidence, no PASS. A criterion with no evidence is shown as UNVERIFIED — a first-class status, never hidden and never rounded up.

2. Every check: what a PASS proves — and what it cannot prove

The 12 automated checks cover 6 of the 33 Security Trust Services Criteria (18.2%) with automation. The remaining criteria are covered by the manual-evidence task workflow described in section 4 — not by automation we pretend exists.

Check	Source	Criteria	A PASS proves	A PASS cannot prove
GitHub org enforces 2FA `gh-2fa-enforced`	github	CC6.1	Every org member authenticated with two-factor at collection time.	Does not prove 2FA was enforced for the whole audit period; does not cover non-SSO personal access tokens.
Default branch requires PR review `gh-branch-protection`	github	CC8.1	Direct pushes to the default branch are blocked; changes require review.	Does not prove reviews were meaningful; does not cover deploy approvals.
No stale outside collaborators `gh-outside-collaborators`	github	CC6.2	Outside collaborators list is current and reviewed.	Does not prove provisioning followed an approval workflow.
Code repos are private `gh-repo-visibility`	github	CC6.1, CC6.6	No production code repo is publicly readable.	Does not prove private repos have correct internal access.
Google Workspace enforces 2-Step Verification `gw-2sv-enforced`	google_workspace	CC6.1	2SV enforced for all non-exempt users at collection time.	Does not prove enrollment across the full audit period; exempted users need manual review.
Super-admin count within limit `gw-admin-least-privilege`	google_workspace	CC6.2	Number of super admins is at or below the configured threshold.	Does not prove each admin grant was approved; custom roles need review.
Terminated users deprovisioned `gw-offboarding-current`	google_workspace	CC6.3	No suspended user retains an active license beyond the grace period.	Does not prove deprovisioning happened within 24h of termination; needs HR termination dates for full testing.
IAM password policy meets baseline `aws-password-policy`	aws	CC6.1	Account password policy meets length/complexity/reuse baseline.	Does not cover federated/SSO users; does not prove rotation in practice.
MFA enabled for all IAM users `aws-mfa-users`	aws	CC6.1	Every active IAM user has an MFA device registered.	Does not prove MFA was used at each sign-in; root account checked separately.
Root account has MFA `aws-root-mfa`	aws	CC6.1	The AWS root user has MFA enabled.	Does not prove root credentials are vaulted or access keys removed.
CloudTrail multi-region logging enabled `aws-cloudtrail`	aws	CC7.2	API activity is logged across regions to a trail.	Does not prove anyone reviews the logs; needs alerting to be a full CC7.2 story.
S3 public access blocked at account level `aws-s3-public-block`	aws	CC6.1, CC6.6	Account-level S3 Block Public Access is fully enabled.	Does not prove individual bucket policies are least-privilege.

3. The hash chain: verify it yourself

Every evidence record in a workspace is hash-chained. Each record carries prev_hash and record_hash = SHA-256(prev_hash + canonical JSON of the record), starting from a fixed genesis value. Changing any field, deleting a middle record, or reordering records breaks verification at exactly that position.

Re-verify any time: GET /api/v1/evidence/verify returns {ok, records, broken_at, head_hash} for your workspace.
What the chain proves: a record has not changed since it was chained.
What the chain does not prove: that the underlying fact was true at collection time. That is the collectors' job (section 1) — the chain protects the record, not the reality it describes. It is a hash chain, not a blockchain, and it certifies nothing.

4. Freshness, readiness, and manual evidence

Freshness: every record carries an expiry (expires_at, set from its freshness window). An expired record counts as not passing in readiness — stale evidence decays visibly instead of silently passing an audit.
Readiness: readiness = fresh passing evidence / applicable checks, with the denominator always shown. A readiness score is an evidence-state summary. It is not a SOC 2 report, and it is not an audit opinion.
Manual evidence: all 33 criteria (CC1.1–CC9.2) have evidence-collection tasks with owners and freshness. Governance criteria that automation cannot honestly check are worked as tasks — that is the workflow, not a gap we hide.

5. Exit fairness — what we owe you

Month-to-month, always. No annual lock-in, no renewal uplift, no per-framework fees on the published tiers. The price you start at is the price that renews.
If you cancel: your workspace is suspended for writes, but your evidence stays readable and exportable. Your auditor pack is yours — leaving never deletes your proof.
If we miss: a failed collection is recorded as ERROR evidence with the reason attached, in your workspace, where you can see it — never quietly retried into a PASS.

6. What ProofLane cannot prove

ProofLane is compliance automation software. We are not a certification body, not a CPA firm, and not a law firm. Only a licensed independent CPA firm can issue a SOC 2 report.
Our control mappings are DRAFT pending independent compliance-advisor review, and they are labeled DRAFT in the product, in exports, and on this site until that review happens.
A point-in-time check cannot prove a control operated for a whole audit period — each check above says so in its own row. Operating effectiveness over time is what your auditor tests.
We make no claim about audit outcomes. We organize evidence; auditors decide.