Cryptography you can inventory and renew
Keep certificates and keys under governed issuance, renewal, delivery, and rotation — so cryptography is managed as a process, not a one-off ticket.
Supports Security CC6.1 / CC6.7 and Availability A1.2
SOC 2
SOC 2 (System and Organization Controls 2) is a voluntary AICPA framework for how cloud and service providers handle customer data, centred on security, availability, and confidentiality. CertLocker gives security and platform teams one place to manage cryptographic artefacts, scoped credentials, just-in-time host access, and the audit trail that proves it.
When certificates live in spreadsheets, secrets sit on disk, and SSH keys never expire, SOC 2 reviews get hard. CertLocker turns those operational gaps into controlled workflows with evidence.
Keep certificates and keys under governed issuance, renewal, delivery, and rotation — so cryptography is managed as a process, not a one-off ticket.
Supports Security CC6.1 / CC6.7 and Availability A1.2
Store PEMs, tokens, and operational secrets with RBAC, scoped retrieval, and version history instead of shared folders and forgotten copies.
Supports Security CC6 and Confidentiality C1.1
Issue time-limited SSH, RDP, and VNC access with 2FA and protocol, IP, and group constraints — then revoke when the work is done.
Supports Security CC6.1 / CC6.2 / CC6.3
Answer who renewed a certificate, retrieved a secret, created a token, or accessed a host — with events useful for Type I / Type II sample periods and incidents.
Supports Security CC4 / CC7.2 / CC8.1
Security is always in a SOC 2 report. Availability and Confidentiality are the optional categories where CertLocker adds the most operational proof. Processing Integrity and Privacy are largely outside the product.
Required
Protect systems against unauthorized access. CertLocker operationalizes logical access, cryptography, logging, and change evidence for trust infrastructure — strongest on CC6, CC7, and CC8.
Optional
Systems remain available as committed. Inventory, ACME renewal, delivery, and live endpoint probes reduce TLS outage risk before customers feel it.
Optional
Confidential information is protected as committed. Central custody of PEMs, secrets, and tokens with RBAC, scoped retrieval, rotation, and revocation.
CertLocker does not write your policies. It gives you operational answers when reviewers ask how cryptography and access are controlled day to day.
A single inventory of certificates, hosts, secrets, and tokens — with ownership and history instead of tribal knowledge.
Scoped machine tokens, group-based access, and just-in-time sessions reduce standing privilege and shared credentials.
Endpoint probes check what TLS endpoints actually serve, so drift and expiry risk show up before an audit finding or outage.
Mapped to AICPA Trust Services Criteria. Use this with your system description — as supporting operational evidence, not a claim that CertLocker covers every control.
| What you need to show | How CertLocker helps | Criterion |
|---|---|---|
| Logical access is controlled | One access model across artefacts, secrets, tokens, and hosts — need-to-know retrieval and mediation | CC6.1 |
| Access is authenticated before use | Identity-tied tokens and sessions; 2FA at issuance; protocol, IP, and group constraints | CC6.2 |
| Access follows role and least privilege | Groups and RBAC; scoped machine tokens; rotate / renew / revoke instead of standing shared keys | CC6.3 |
| Cryptography and keys are managed | Certificate inventory, ACME issuance and renewal, key custody, rotation, and governed delivery | CC6.7 |
| Anomalies and drift are monitored | Endpoint TLS probes detect drift and expiry risk between issued inventory and what production serves | CC7.2 |
| Security events can be evaluated | Audit events for certificates, secrets, tokens, ACME, probes, and host access | CC7.3 |
| Changes leave a history | Version history and audit of secret, certificate, and token changes | CC8.1 |
| TLS availability risk is visible | Expiry visibility and live endpoint checks so failures are caught before customer-facing outages | A1.1 |
| Trust paths can be recovered | Repeatable ACME renewal and delivery workflows restore trust paths without ad-hoc SCP or chat | A1.2 |
| Confidential cryptographic assets are identified | Inventory of certificates, keys, secrets, and tokens as confidential assets under custody | C1.1 |
| Confidential access can be revoked | Revoke tokens, rotate secrets, and expire host sessions to reduce residual access | C1.2 |
.env sprawlCertLocker strengthens cryptography, secret custody, privileged access, and logging for infrastructure trust. It is not your full SOC 2 program or your auditor.
You still own policies, risk assessment, the system description, control environment culture, people and physical controls, vendor governance, and the CPA examination. Describe CertLocker as supporting evidence for selected Trust Services Criteria — not as making the organisation “SOC 2 certified.”
In short: CertLocker helps you demonstrate how certificates, secrets, and host access are controlled and logged — so SOC 2 reviews have operational proof behind the paperwork.
No. CertLocker helps you operate and evidence selected Trust Services Criteria for cryptography, secrets, logical access, monitoring, and audit. A CPA still examines your system description and controls. Certification claims belong to your SOC 2 report — not to the platform.
Inventory of certificates and related assets, governed issuance and renewal, secret and credential custody with access history, scoped tokens, time-limited host access, endpoint verification, and a clear audit trail of who did what and when — useful across Type I and Type II sample periods.
Security Common Criteria around logical access and cryptography (CC6), monitoring and security events (CC7 / CC4), and change history (CC8), plus Availability of TLS trust paths (A1) and Confidentiality of keys and secrets (C1). Processing Integrity and Privacy are largely outside the product.
See how CertLocker fits your certificate, secret, and access workflows — or talk through what auditors will see in your environment. Also exploring ISO 27001 or Operator Trust?