The auditor asks for evidence. It is already written.
SOC 2 and ISO 27001 both ask you to show that access is granted deliberately, reviewed periodically, and removed when it should be. Driply keeps that record as work happens, so the request that used to cost a week becomes an export.
- GRANTBeverly Crusher → Figma · admin
- REVIEWQ2 access review · passed
- REVOKETasha Yar → AWS · offboarded
An access control audit asks three questions: who has access, who decided they should, and what happened when they no longer needed it. Answering them from Slack threads and a spreadsheet is a week of archaeology that produces a document nobody fully trusts. Driply records the answer as the work happens. Every request, approval, grant, level change, expiry, and revoke lands on an append-only log with an actor and a timestamp, so producing SOC 2 or ISO 27001 evidence is an export, not an investigation.
The evidence problem is a timing problem
Most teams do govern access reasonably well. Someone asks, someone sensible says yes, the access gets granted. What they don’t have is proof, because the decision lived in a DM and the grant lived in the tool.
So when the auditor arrives, the work is reconstruction: scroll back through channels, export member lists from a dozen admin panels, and assemble a spreadsheet that asserts a history rather than evidencing it. It is expensive, it happens under deadline, and the resulting document is the weakest part of the control.
A trail that cannot be edited
Every access event is written once and never updated or deleted, with the actor, the reason, and the timestamp. That immutability is the property an auditor is actually testing for, and it is enforced in the database, not by convention.
The review as a workflow
Run the periodic review as a campaign: scope it, route each line to the tool’s owner, and certify, flag, or remove each grant. Completion produces a signed-off evidence pack covering the period, and the cadence schedules the next one.
Export in the shape they asked for
Filter the log by person, tool, verb, or date range and export branded PDF or CSV. Attach it to the request and move on, whether the framework is SOC 2, ISO 27001, or a customer’s own control questionnaire.
The result, An audit request answered in an afternoon, from a record you didn’t have to write.
Why a by-product beats a project
Evidence assembled at audit time documents what people remember. Evidence captured at decision time documents what happened. The difference is not effort, it is accuracy, and it is the reason auditors weight a contemporaneous record so much more heavily than a reconstructed one.
Driply is built so the record is the cheapest path: the request has to be approved to become a grant, and the grant is what writes the event. Nobody keeps the log up to date, because nobody can get access without producing it. Access reviews and the exportable evidence pack are available on Business and up; the append-only log itself is on every plan, including Free.
Driply documents and proves the access. Your admin or the tool’s owner performs the actual account change in each tool, and that attestation is part of the record. Driply never writes to your tools.
Driply documents and proves access. It doesn’t provision or revoke inside your tools, and by design never writes to them. You stay in control of the actual access.
Questions, answered.
- What evidence does a SOC 2 access review need?
- Typically: the current access list, who approved each grant and when, evidence that access was reviewed on a defined cadence, and proof that leavers were removed. Driply keeps all four on one append-only log and exports them for any period.
- Can the audit log be altered?
- No. Events are append-only at the database level: they cannot be updated or deleted, including by an admin. That is what makes the export evidence rather than an assertion.
- Does this replace our compliance platform?
- No. A compliance platform tracks your controls across the whole framework. Driply is the system of record underneath the access control specifically, and it exports into whatever platform or auditor asks. Many teams run both.