Technology and SaaS
Audit evidence and data protection for software companies.
Security built for companies that build software
Customer trust grows when a company can explain what it protects, what it observes and how it responds. A usable security record helps a growing software team answer those questions with evidence.
Frameworks
| Framework | Criterion | Asks | Security support |
|---|---|---|---|
| SOC 2 | CC7.2 | Monitor components for anomalies. | Correlation rules, user risk scores and Detection baselines. → |
| CC7.2 focus | Monitor detection tools. | Alerts when a source goes silent or unhealthy. → | |
| CC7.3 | Evaluate security events. | Cases with deadlines and history. → | |
| ISO 27001 | 8.15, 8.16 | Logging and monitoring. | A ready-made ISO/IEC report. → |
| EU | 2024/2690 3.2.5 | Logs protected from change. | Signed, chained logs. → |
| GDPR 28(3)(h) | Information and audits for controllers. | An export with a standalone verifier. → |
SOC 2 CC7.2
Monitoring records show activity; reviews and incident decisions show what the team did with it. Keep them connected so an auditor can examine the operation of the control over the assessment period.
Shadow AI
Developers need clear rules for sharing code and customer information with AI tools. DLP content and secret-detection policies can inspect covered prompts and uploads, with a route for approved development work.
Account takeover
An attacker may use a valid token or password while behaving differently from the account’s usual activity. Historical context and connected source records help the analyst investigate that change.
GDPR Article 28
Local hosting can limit the information a security provider processes. Assess the actual support access, integrations and data flows before determining the parties’ roles under GDPR Article 28.
By rule
ISO 27001 8.15, 8.16
Logging and monitoring. Scheduled SIEM reports organize the relevant records; review findings and follow-up show how the information was used.
EU 2024/2690 3.2.5
Logs protected from change. Signed records from a SIEM and verification material support an independent check of the evidence’s integrity.
Questions
Would we see a stolen session?
Changes in sign-in, network or process behavior flagged by AI Detection can give the team a lead. The result depends on available telemetry and the timing of analysis, so evaluate it on representative account-takeover scenarios.
What stays with the company?
The company owns its SOC 2 and ISO 27001 programs, development environment and application-security controls. Monitoring scope should identify supported hosts, cloud sources and responsibilities.
Guide
What does SOC 2 CC7.2 require?
Monitoring system components for anomalies and analyzing them as possible security events.
How can a company stop source code leaking into AI tools?
Inspect prompts, uploads and API requests to AI services for source code and secrets.
What logging does NIS2 require of cloud providers?
Implementing Regulation 2024/2690 requires logs kept for a set period and protected from change.
How ARRTECH takes care of SaaS security
Connects security activity into a signed record, giving incident decisions and board reporting evidence that can be independently verified.
Protects intellectual property and customer trust, with content-aware controls that let organizations adopt AI on their own terms.
Expands response capacity through automation, with defined human authority and a record of who approved what.
Finds changes in behavior that predefined rules miss, connecting the signs of an attack so teams can understand what warrants action.
Investigates alerts, tests explanations and prepares the evidence, giving analysts more capacity while people retain authority over the response.
