Do we have to grant Sprinto code-level access for SOC 2 compliance, and what is the specific need for code-level access?

No, you do not have to grant Sprinto code-level access for SOC 2 compliance for every application.

Sprinto operates on the principle of requiring the least access privilege necessary to support the level of automation needed for SOC 2 compliance. Our primary goal is to ensure your security while enabling seamless compliance processes.
If your source code provider supports fine-grained API controls that restrict access to metadata (such as Github), Sprinto will leverage these capabilities. In such cases, there is no need for code-level access, as the API allows us to interact only with the necessary metadata without touching your codebase.

However, if the source code provider does not offer fine-grained access control through their API (such as bitbucket) , we offer two approaches to maintain the integrity and security of your systems while still integrating effectively with Sprinto:

1. Customer Permission with Transparency: If you choose to grant Sprinto the required permissions, we build a completely transparent API log. This log provides full visibility into all requests made by Sprinto, ensuring that you have complete oversight of every interaction. This approach allows you to monitor and audit the access granted, giving you peace of mind that your sensitive data is being handled securely.
2. Limited Scope with Workflow Checks: Alternatively, you can choose to limit the scope of permissions granted to Sprinto. In this scenario, some parts of the compliance process will be automated, while other parts will be managed through workflow checks. This hybrid approach allows you to maintain tighter control over your systems while still benefiting from Sprinto’s automation capabilities.

In both scenarios, Sprinto’s approach is designed to minimize risk and ensure that only the minimum necessary access is granted to achieve SOC 2 compliance. By prioritizing security and transparency, Sprinto enables your organization to stay compliant without unnecessary exposure or risk.