Case Study
How Asteri Went From a 45% SOC 2 Readiness Score to Audit-Ready in 16 Weeks
How Asteri, Vanta, and AllCode rebuilt an AI-native SaaS startup’s AWS footprint into an audit-ready, multi-tenant environment — without slowing down the product.
Segment: Enterprise SaaS / AI Agents | Use Case: SOC 2 Compliance & Multi-Tenant AWS Architecture | Industry: AI-Native Work Intelligence & Orchestration
The Compliance Challenge
A Hand-Deployed AWS Environment Was Never Built for an Auditor
Asteri is an AI-native work intelligence and orchestration platform serving enterprise HR and clinical use cases. When an enterprise customer moved toward signing a Cloud Services Agreement with a formal SLA and uptime commitments, Asteri needed infrastructure that could credibly back those promises — and its existing environment couldn’t. An October 2025 gap analysis found no MFA on the root account, no AWS Config, CloudTrail running without log file validation, S3 buckets secured with only basic AES256 instead of customer-managed KMS keys, no centralized secrets management, and everything concentrated in a single region. Deployments were entirely manual, with no CI/CD, spread across a mix of legacy EKS, App Runner services, and self-managed Redis/Postgres containers.
The stakes were straightforward: the enterprise contract — and the credibility to win more like it — was gated on SOC 2. Every week of delay pushed out revenue, extended exposure from critical findings like the missing root MFA and incomplete audit trail, and let unhardened, manually deployed infrastructure accumulate more drift to remediate later.
A Vanta rollout made the gaps impossible to ignore, scoring overall readiness at 45% org-wide. Asteri needed a partner to do the AWS engineering Vanta’s monitoring couldn’t do on its own — without disrupting the legacy product still running in production.
The Solution
A Multi-Account, Terraform-First AWS Environment Aligned to SOC 2
Vanta provided continuous control monitoring, audit scoping, and evidence collection; AllCode did the AWS engineering Vanta can’t do on its own — account restructuring, Terraform build-out, control implementation, policies and procedures, DR runbooks, and mock-audit preparation — in a single 16-week program.
Multi-account AWS Organizations
Stood up a dedicated Production, Development, and Security/Logging account structure, with the legacy product environment deliberately scoped out of the Vanta audit boundary so remediation could focus entirely on the go-forward platform.
Net-new multi-tenant environment
Defined an entirely new production environment in Terraform: a shared VPC across two AZs, private subnets for workloads, ECS Fargate services per tenant, Aurora PostgreSQL Serverless v2 with a dedicated logical database per tenant, a dedicated S3 bucket per tenant, a shared ALB with host-based routing, and Secrets Manager namespaced per tenant.
Security controls mapped to Trust Service Criteria
GuardDuty across every account with centralized findings, organization-wide AWS Config with SOC 2 rules, Security Hub cross-account aggregation, a CloudTrail organization trail with log file validation, KMS customer-managed keys, VPC Flow Logs and DNS query logging, Inspector in production, and AWS Backup for cross-account backup.
Delivery hardening
Replaced manual deployments with GitHub Actions CI/CD and hardened container images from ECR, swapped self-managed Redis/Postgres containers for managed ElastiCache and RDS, moved DNS from GoDaddy to Cloudflare with delegated access, and added Clerk SSO for authentication.
AI-specific security
Scoped penetration testing to both the web application and the LLM layer — the RAG pipeline stores vectors in RDS and calls out to OpenAI for embeddings and inference — so the AI attack surface was tested explicitly, not assumed safe by omission.
Implementation
A 16-Week, 4-Phase Delivery Program
Gap analysis closed on October 21, 2025, the SOW was signed two days later on October 23, and engineering kickoff landed the week of December 29, 2025 — a 16-week, 4-phase program from there to audit-ready:
- Phase 1 (Weeks 1–4): Multi-account security foundation — GuardDuty in all three accounts, org-wide Config with SOC 2 rules, cross-account IAM roles, Security Hub aggregation, S3 security controls, and centralized KMS key management.
- Phase 2 (Weeks 5–9): Centralized monitoring and compliance — cross-account CloudWatch dashboards, Inspector vulnerability assessments, automated Config Rules monitoring, CloudTrail log validation, an AWS Backup strategy, and VPC Flow Logs/DNS logging.
- Phase 3 (Weeks 10–14): Governance and documentation — SOC 2 policies and procedures for the 3-account structure, cross-account incident response, data classification and retention, a privacy impact assessment, security awareness training, and centralized audit evidence collection.
- Phase 4 (Weeks 15–16): Testing and audit prep — org-wide security assessment and penetration testing across the web app and the AI/LLM layer, a final gap analysis, consolidated evidence packages, and a mock SOC 2 audit simulation.
Results
Before & After: From Manual, Single-Account AWS to Audit-Ready
| Control Area | Before (Oct 2025 Gap Analysis) | After (Program Delivery) |
|---|---|---|
| SOC 2 readiness | 45% org-wide at the October 2025 gap analysis | Audit-ready across all four SOW phases |
| Root account MFA | Not enabled — critical finding | Enforced on root and all IAM users |
| Compliance monitoring | No AWS Config recorders anywhere | Org-wide Config + Security Hub with SOC 2 rules |
| Audit trail integrity | CloudTrail log file validation disabled | Organization trail with log validation enabled |
| Encryption | Basic AES256 on S3; no central key management | KMS customer-managed keys, centrally managed |
| Secrets management | No centralized secrets management | Secrets Manager, namespaced per tenant |
| Deployments | Fully manual; no CI/CD | GitHub Actions pipelines with hardened images |
| Tenant isolation | Shared, hand-configured resources | Per-tenant database, ECS services, S3 bucket, and secrets |
| Disaster recovery | No DR plan; single region, no tested restore | Terraform redeploy plus a documented restore runbook and recovery testing |
| Enterprise SLA posture | SLA commitments unbackable | SLA schedule submitted with monthly KPI reporting, P1 response under 2 hours, 24/7 coverage until restored |
Business Impact
What Audit-Ready Unlocked
Asteri can now put a defensible, audit-ready AWS environment in front of enterprise customers and auditors alike, with per-tenant data isolation built into the architecture rather than bolted on after the fact. The compliant environment also becomes the landing zone for every future tenant Asteri onboards — each new enterprise customer means a new ECS service, a new Aurora logical database, and a new S3 bucket, all inside the same control framework. Next up: a SOC 2 Type II observation period on the new environment, multi-region disaster recovery (cross-region Aurora snapshots and S3 replication are designed but disabled for cost today), OpenSearch/Neptune expansion for the AI data layer under the same controls, and recurring annual penetration tests covering both the web and LLM attack surfaces.
%