Frameworks and controls

A “SOC 2 control evidence” pack organizes Zespan’s recorded facts under a framework’s named controls, instead of under the agent-centric sections a Compliance Card uses. One framework is registered today.

​

SOC 2

Selecting SOC 2 control evidence as your document type maps evidence to three Trust Services Criteria controls: Each control’s narrative is explicit about scope. CC6.1, for example, states plainly that the section “reports what Zespan recorded; it does not assess whether those assignments were appropriate.” A control document reports observed facts — never a judgment about whether those facts satisfy the control.

​

Coverage

Before you generate, the Compliance page’s Coverage for this period panel runs the same evidence queries each control would use and shows, per control, whether at least one of its sections produced records for the period you’ve chosen — without rendering or storing a document. A control with zero records across every one of its sections shows as uncovered, along with which sections came back empty, so a gap in the underlying data is visible before you generate — and possibly hand to an auditor — the document itself. This mirrors what the generated document itself does at render time: a section with no records for the period prints the literal text “No evidence available for this period.” rather than being silently omitted.

​

reviewedOn / reviewedBy

Every SOC 2 control evidence document — in every format — carries a review-attribution line:

Reviewed: 2026-08-08 by Zespan engineering — not reviewed by a licensed auditor

This is deliberately printed on the document itself rather than buried in a settings page. The SOC 2 mapping shipped in this release was authored and reviewed internally, by Zespan engineering — it has not been reviewed by a licensed external auditor. Treat a generated control-evidence document as a well-structured starting point for your own SOC 2 evidence collection, not as a substitute for your auditor’s own judgment about what satisfies your specific control environment.

​

Not yet available

​

Next steps

• Evidence packs — the two document kinds and how to generate one
• Verification — re-checking a generated document’s citations
• Compliance evidence limitations — permanent data gaps stated in the documents themselves