SOC2 Compliance: How to Audit Database Access

If your company is pursuing SOC2 Type II compliance, you know the drill. You need to prove to an auditor that you have controls in place to protect customer data.

One of the hardest areas to prove is Database Access Control.

The Auditor’s Questions

Expect your auditor to ask these specific questions:

1. “Who has access to the production database right now?”
2. “Show me the evidence that access was revoked for the last 3 employees who left.”
3. “Show me a log of all queries run against the users table in the last 30 days.”
4. “How do you prevent unauthorized developers from seeing PII?”

If your answer involves “We share a password in 1Password” or “We check the Postgres logs manually,” you are going to have a bad time.

The Challenge with Native Database Logs

You might think, “I’ll just enable logging on Postgres/MySQL.”

• Noise: Database logs are incredibly noisy. They log every internal system query, heartbeat, and index scan. Finding human activity is like finding a needle in a haystack.
• Lack of Identity: If everyone connects as db_user, the logs show db_user running queries. You cannot prove which human did it.
• Performance: Enabling full query logging on a high-traffic production DB can degrade performance.

The VaultSQL Approach to Compliance

VaultSQL simplifies SOC2 compliance by acting as an identity-aware proxy.

1. Identity-Linked Logs

Since users authenticate with SSO, every query in the VaultSQL audit log is tagged with [email protected], not just db_user.

2. Human-Centric Filtering

VaultSQL logs filter out the system noise. You see the queries that humans wrote and executed in the workbench.

3. Access Reviews

The “Members” list in VaultSQL gives you a single pane of glass to show the auditor exactly who has access.

• Auditor: “Show me revocation evidence.”
• You: “Here is the audit log showing Alice was removed from the ‘Engineering’ group on her last day, and her access immediately ceased.”

Summary

Compliance shouldn’t be a scramble at the end of the year. By using a tool that enforces identity and logging by default, you make SOC2 evidence collection a trivial task—just export the logs and send them over.