Assessor Operations Portal
Verify platform-wide SOC 2 Type II controls, review change history, and trigger live audit pipelines.
Audit Walkthrough Sequence
Assessor Onboarding
Review environmental setup configs, database requirements, and parameters in the primary README.
Index Mapping Check
Cross-reference compliance assertions with specific files using the interactive Control Coverage Matrix.
Automation Verification
Run the packaging suite `collect-soc2-evidence.sh` to trigger active tenant RLS checks and telemetry passes.
Sealed Envelope Check
Verify output signature SHA-256 HMAC logs to confirm zero operational configuration drift.
Assessor NDA Package
GatedControl Coverage Matrix (SOC 2 Type II)
Select a control block below to audit its core assertions, code reference parameters, and testing script paths.
User identity, MFA verification, role authorizations, and logical access blocks are strictly enforced.
Evidence Packaging Terminal Emulator
Continuous Monitoring FAQ
Understand how Venko’s automated auditing layer monitors compliance signals and safeguards operations.
Q. What is continuous compliance monitoring?
Instead of conducting manual compliance audits once a year, our platform runs automated validation loops every few minutes. These agents continuously verify that role access gates, row-level database barriers, and maker-checker segregation rules are operational.
Q. What happens if a check fails or degrades?
If any validation fails (e.g., if row-level security connection properties drift or a ledger anomaly is detected), the Trust API changes its status to DEGRADED. This instantly triggers alerts to compliance teams (via Slack or PagerDuty webhooks) and syncs the anomaly to connected GRC platforms.
Q. How does this verify the Zero Custody model?
Our ledger double-entry reconciliation loops assert that actual physical wallet holdings match cryptographic ledger states to the penny. If any discrepancy is identified, the reserve SLA status fails, allowing operators to isolate system components before transaction executions.
Q. Who can see this telemetry data?
The Trust Diagnostics API serves only anonymized, high-level verification indicators, release versions, and enclave latency performance metrics. It contains no customer personal data, account keys, secret tokens, or private transaction records.