Compliance
SOC 2 complementary user entity controls (CUECs) explained
CUECs are the controls your SOC 2 report assumes your customers run. Learn how to find yours, word them, and tell customers without losing the deal.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedCompliance
SOC 2 code review when you only have two engineers
Change management still applies to a tiny team. Here is how two engineers can enforce review, handle urgent fixes and keep evidence without slowing down.
Oct 18, 20263 min read
Compliance
SOC 2 on a public cloud: which controls are yours, which are theirs
Your cloud provider's report covers its data centers, not your configuration. Here is how to split SOC 2 controls and what evidence to keep.
Oct 18, 20263 min read
Compliance
SOC 2 backup and restore test evidence auditors accept
A backup job running is not proof you can recover. Here is the evidence to keep for a SOC 2 audit: schedules, alerts, restore tests and who signed off.
Oct 18, 20263 min read
Compliance
Questions to ask your SOC 2 auditor at kickoff
A good kickoff call prevents expensive surprises. Ask your SOC 2 auditor these questions about scope, evidence, sampling, timing and report wording.
Oct 18, 20263 min read
Compliance
SIG Lite vs SIG Core: which questionnaire to send or request
SIG Lite suits lower-risk vendors and SIG Core suits deeper reviews. Learn how the two differ, what changed in 2025, and how to scope a request sensibly.
Oct 18, 20263 min read
Compliance
Share your SOC 2 report: NDA, request form or open download?
How to decide whether your SOC 2 report goes behind an NDA, a request form or a public link, and what to put on the page either way.
Oct 18, 20263 min read
Compliance
Separation of duties when your team is only five people
Small teams cannot split every duty, but they can stop one person acting alone on risky actions. Here are practical pairings and compensating controls.
Oct 18, 20263 min read
Compliance
A one page security overview for buyers: what to put in it
A short, honest security overview can answer most buyer questions before a questionnaire arrives. What to include, what to leave out, how to keep it true.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.