“The whole SOC2 audit is essentially a series of screenshots.”
Fly.io got its SOC2, and its own blog post admits the certification misses most of how the company actually secures anything. Customers demand it anyway, because procurement needs a box to tick. The audit rewards screenshots of process, not security. Read the pentest reports and ignore the badge.