Amp maintains SOC 2 compliance by ditching the pull request workflow
The company challenges the industry assumption that mandatory PRs are a regulatory requirement for security certifications.
Software engineering teams often view the pull request (PR) as a non-negotiable requirement for SOC 2 compliance. However, Amp is proving that the industry-standard 'four-eyes' review process is a choice of implementation rather than a regulatory mandate.
Will Dollman of Amp shared that the company maintains its SOC 2 compliance while entirely eschewing the PR workflow. Instead of relying on traditional peer reviews before merging, Amp utilizes a combination of restricted push access to the main branch, GitHub-enforced verified signatures on commits, and an automated CI validation pipeline designed to block faulty changes from reaching production. To satisfy audit requirements, the company maintains detailed audit trails that link specific commits back to internal threads, recording the context and authorization for each change.
The Compliance Misconception
In many software organizations, the PR is treated as a mandatory legal hurdle. This stems from a common interpretation of SOC 2 as requiring a second human to review every line of code. In practice, Amp—a small team of approximately 20 people—has operated on a continuous shipping model since its first commit to prioritize speed and high internal trust.
According to the SOC 2 Trust Services Criteria, there is no explicit requirement for pull requests or a second human reviewer. The framework instead requires that changes to the production environment are authorized, tested, approved, and recorded. While a PR is a common way to satisfy these criteria, it is not the only method.
Redefining Risk Management
This approach challenges the prevailing industry assumption that rigid process overhead is a prerequisite for security certifications. By tailoring controls to their specific risk profile and team size, Amp suggests that companies can avoid a one-size-fits-all checklist in favor of more efficient, automated safeguards.
"SOC 2 doesn’t require pull requests," Dollman stated. "It requires that you think about your risks."
The Path Forward
As more companies seek to balance agility with compliance, Amp's model provides a blueprint for replacing manual bottlenecks with technical constraints. The shift suggests a move toward "compliance as code," where verified signatures and automated pipelines provide the same level of assurance as a manual sign-off.
What remains to be seen is how this model scales. While a 20-person team can maintain high trust and clear internal threads, larger organizations may find that the PR process serves a pedagogical or quality-control purpose that extends beyond the narrow requirements of a SOC 2 audit.