"That's not SoC 2 compliant"

Amp, a software company, bypasses traditional pull requests and pushes code directly to main while maintaining SOC 2 compliance through alternative controls: restricted push access, signed commits, automated CI/CD testing, and detailed audit trails. The company's auditors confirmed that SOC 2 doesn't mandate pull requests—it requires changes be authorized, tested, approved, and recorded—and Amp's system achieves this through purpose-built processes suited to its small, high-trust team rather than industry defaults.