Resources
The questions buyers and auditors actually ask.
One answer per question, written to be quoted by an AI assistant and read by an auditor. One new post a week for the first six months.
Articles
- What an auditor samples in a pull requestThe population, the sample, and the five things an auditor looks for on each sampled PR. Build the record so it is already there.2026-11-09 · SOC 2 · ISO 27001 · PCI DSS · SOX
- Separation of duties with AI code reviewWriting a change and approving it for release are conflicting duties. An AI reviewer does not add a second duty holder. Here is what does.2026-11-09 · SOC 2 · ISO 27001 · SOX · CMMC
- Does AI code review count for SOC 2?Not on its own. What CC8.1 actually asks, how auditors test it, why a bot approval fails the test, and what makes AI review count as evidence.2026-11-09 · SOC 2
- Can Copilot approve pull requests under PCI DSS?GitHub lets Copilot approvals count toward required approvals. PCI DSS 6.2.3.1 names individuals other than the author. The two are not the same gate.2026-11-09 · PCI DSS
Auditor Q&A
Ten questions, answered the way we answer them on a call.
- Does an AI reviewer's approval count for SOC 2?
- Not today. Auditors are not accepting AI-only approval as standard practice, even though GitHub now lets Copilot approvals satisfy required-approval rules. A human other than the author still needs to approve. That is the Officer.
- Is it really a person?
- Yes. Every approval is posted by a named Officer from their own GitHub account, and their profile and credentials are available to your auditor.
- How fast?
- Most routine PRs are decided within an hour on the Standard tier; Priority is one hour, Always-on is thirty minutes, around the clock, US-based.
- What does the Officer actually check?
- Your Security & Compliance Model: sensitive paths, required checks, forbidden patterns, dependency policy, and the findings your AI reviewers already posted.
- What happens when they find something?
- The PR gets Request Changes with the model clause cited. Fix it, push, and only the new diff is re-reviewed.
- Can we auto-merge after approval?
- Yes. Key your automation to the psco/approved check. PSCO never merges.
- Who sees our code?
- Your Officers, under confidentiality terms, through a least-privilege GitHub App. PSCO holds no code at rest beyond the review session and has its own SOC 2 report.
- How is price set?
- From your PR history: $500 includes 100 PRs a month, then $3 to 2,000 and $2.50 beyond, with Priority and Always-on tiers at 1.3 and 1.6 times.
- GitLab or Bitbucket?
- On the roadmap; GitHub first.
- What is the guarantee?
- Audit acceptance, coverage of every in-scope PR, and SLA credits, all in the contract.
Changelog
Product changes will be listed here from public launch: new reviewers recognized, model schema changes, Evidence Pack formats, GRC adapters. Until then, the works-with list is the closest thing to a changelog.
See your exact price before you talk to anyone.
Connect GitHub, pick the repos in scope, and get a quote from your real PR history in two minutes.