Field notes on SOC 2 audits, evidence, and the parts of compliance nobody puts in the sales deck.
Most SOC 2 audit exceptions aren't bad controls, they're controls you can't prove. How to design evidence that holds across the full Type II window.