The SOC 2 evidence is the account audit trail

The auditor's evidence request has 140 line items. Who can access production. Who changed what. When access was revoked.

Three records answer most of them, and you didn't build any of them. The account audit trail records who created, deleted, and re-permissioned every container and token. Terminal session history, exported as HTML, shows every command anyone ran in production and when. The file journal shows every config mutation with a revision. You export each for the audit window and attach them.

The previous year's evidence folder was 300 screenshots taken by an engineer who should have been shipping. This year's is three exports and a cover note explaining where each came from.

Evidence collection used to be a quarter of screenshots. Now it's three exports the substrate already kept.