SOC 2 Compliance with Teleport

Yes. Teleport Cloud is SOC 2 Type II certified by an independent AICPA-accredited auditor, with annual renewal audits covering the Security, Availability, and Confidentiality Trust Services Criteria. The current SOC 2 report, along with ISO 27001 and other compliance artifacts, is available through the Teleport Trust Center at trust.goteleport.com, where prospects and customers can request documents under NDA. Teleport also publishes external penetration test summaries to simplify vendor security reviews.

Teleport directly supports the Common Criteria controls that make up the bulk of a SOC 2 audit, with deepest coverage in CC6 (Logical and Physical Access) and CC7 (System Operations). Specific capabilities map to CC6.1 (restricting logical access and managing credentials), CC6.2 (access reviews and timely revocation), CC6.3 (role-based access and appropriateness of permissions), CC6.6 (boundary protection and MFA), CC7.2 and CC7.3 (detection and monitoring), and CC7.4 (incident containment). When paired with Access Request approval workflows, Teleport also contributes evidence for CC8.1 change management.

Teleport replaces static credentials like SSH keys, database passwords, Kubernetes kubeconfigs, and cloud API tokens with short-lived x509 and SSH certificates signed by its built-in Certificate Authority. Every human user, machine, workload, and AI agent authenticates through cryptographic identity tied to the organization's identity provider (Okta, Entra ID, Google Workspace, etc.), with no shared secrets to rotate or inventory. Certificate TTLs are configurable and typically measured in hours, which satisfies CC6.1 requirements for restricting logical access, managing credentials for infrastructure, and identifying and authenticating users.

Teleport generates access review evidence automatically through its immutable audit log and exposes it via the Web UI, the tctl CLI, and the Teleport API. Auditors typically need a list of users, their assigned roles, active sessions, access request history with approver identity, and revocation timestamps - all of which can be exported as structured JSON or CSV. Because every permission grant, change, and revocation is recorded as a discrete audit event, organizations can produce a timestamped chain of evidence for CC6.2 without manual screenshotting or spreadsheet tracking.

Teleport proves timely de-provisioning through two mechanisms: short-lived certificates that expire automatically (typically within hours) and Session & Identity Locking that terminates all active sessions instantly. When a user is deactivated in the upstream identity provider, Teleport immediately stops issuing new certificates, and admins can apply a lock to kill any in-flight sessions in seconds. The audit log records the exact revocation timestamp and the identity of the admin who applied the lock, giving auditors direct evidence for SOC 2 CC6.2 and CC6.3 de-provisioning controls.

Teleport enforces least privilege through Role-Based Access Control (RBAC) that grants each identity only the permissions required for its function, and enforces separation of duties through Just-in-Time Access Requests that require peer or manager approval before privileges are elevated. Moderated Sessions add a second layer by requiring a designated approver to join before sensitive commands execute. Access request decisions route through Slack, Microsoft Teams, PagerDuty, or Jira, and every role assignment, request, and approval is captured in the audit log for SOC 2 CC6.3 evidence.

Yes. Teleport extends the same identity, access, and audit controls to AI agents, CI/CD pipelines, and workloads that it applies to human users, which directly addresses the accountability gap auditors increasingly flag for agentic systems. Through Teleport Machine & Workload Identity, every AI agent receives a cryptographic identity, operates under scoped RBAC, and produces a complete audit trail of inputs, outputs, and triggered actions - so privileged actions are always attributable to an accountable identity rather than a shared service account. This satisfies SOC 2 CC6 least-privilege expectations and CC7 monitoring requirements for autonomous systems.

Teleport logs every infrastructure change with the originating identity, timestamp, and command-level detail, regardless of whether the change was initiated by a human, a CI/CD pipeline, or an AI agent. Access Requests route automated and elevated changes through approval workflows in Slack, Jira, or PagerDuty before execution, satisfying CC8.1's requirement for authorized changes with documented request and approval trails. Because the audit log is tamper-evident and immutable, auditors get the full chain of request, approver identity, execution, and outcome - the same evidence pattern expected for traditional change tickets, applied consistently to autonomous workflows.

Yes. Teleport writes tamper-evident audit logs to customer-controlled backends including Amazon DynamoDB, Amazon S3, Google Cloud Storage, and Azure Blob Storage, with retention policies set by the customer to match SOC 2 guidance (commonly 1 year minimum, often 7 years for regulated industries). Teleport Cloud retains audit events according to the plan's documented retention window, and self-hosted deployments retain logs indefinitely based on backend storage configuration. Log entries are immutable once written, which preserves integrity for SOC 2 CC7.2 and CC7.3 monitoring and investigation controls.

Yes. Teleport exports structured JSON audit events to any SIEM via Fluentd, syslog, webhooks, or direct cloud log forwarding, with documented integrations for Splunk, Datadog, Panther, Elastic, Sumo Logic, and AWS Security Hub. Exported events include session metadata, command-level detail, access request decisions, file access (via Enhanced Session Recording), and the identity context for every human, machine, and AI action. Streaming events to a central SIEM supports SOC 2 CC7.2 continuous monitoring, automated anomaly detection, and correlation with other security telemetry.