A former Deloitte SOC 2 auditor named Yuanlun Yin published his entire audit methodology on GitHub on August 4, 2026, under a CC BY 4.0 license, through his company Chiaro. It's not a summary or a checklist — it's the actual control library, test attributes, and pass/fail calibration data an AI or a human can read before anyone pays for an audit.
Short answer: Chiaro, founded by ex-Deloitte auditor Yuanlun Yin, open-sourced its full SOC 2 methodology at github.com/Chiaro-HQ/methodology: 86 controls, 355 test attributes, 61 Trust Services Criteria mappings, and 498 calibration examples, all in machine-readable JSON under CC BY 4.0. You can point Claude, Cursor, or any AI at it to self-assess SOC 2 readiness before paying for a real audit.
Last updated: August 5, 2026 · By Vishal Swami, Founder & Lead AI Reviewer, AISagely
In my testing, I cloned the repo and read through the framework files in the order Chiaro's own AGENTS.md tells an AI model to read them: controls first, then test attributes, then the calibration examples, then the criteria and evidence mappings. What stood out is how blunt the calibration data is about where AI graders go wrong — of the 498 worked examples, 303 correct a case where the model was too strict and 195 correct one where it was too lenient, with the "right" verdict spelled out next to the model's original guess. That's a more honest starting point than most compliance-automation marketing I've read. Here's what's actually in the repo, how to use it, and where it stops.
What you'll need
You don't need a Chiaro account to read the open-source SOC 2 methodology — it's a public GitHub repo, so a browser or git clone is enough. To actually point an AI at it the way Chiaro intends, you need an AI tool that can read local files or a repo, like Claude Code, Cursor, or Codex, since the whole point of shipping controls.json and test_attributes.json as structured data instead of prose is that a model can load them directly. If you want Chiaro to run the paid readiness platform or the audit itself, you'll eventually need an account at chiarohq.com, but nothing in the open-source repo requires one.
Step-by-step: using the methodology
1. Clone or browse the repo
Go to github.com/Chiaro-HQ/methodology and either clone it or browse the framework/ and method/ folders in the browser. framework/ holds controls.json (86 controls), test_attributes.json (355 test attributes with pass criteria), criteria.json (61 Trust Services Criteria), evidence_map.json (22 accepted evidence sources), and calibration-examples.json (498 worked judgment calls). method/ holds the testing procedure documents, including type2-testing.md and a scoping playbook.
2. Read AGENTS.md before anything else
This is the file that makes the "for your AI" framing literal. It tells any model reading the repo to start with controls, then test attributes, then calibration examples, then the criteria and evidence maps — in that order — and it states plainly that "this is the methodology, not the product." Chiaro is drawing a line between the free framework and the paid platform that operationalizes it.
3. Pick one control and trace it end to end
Rather than dumping the whole repo into a context window at once, open a single control in controls.json, find its matching entries in test_attributes.json, and check evidence_map.json for what counts as acceptable proof. In my testing, this narrow trace was far more useful than a broad summary — it's the same way a real auditor works a control, one at a time, not as a batch.
4. Load the calibration examples before you trust any AI verdict
calibration-examples.json is the part worth reading closely before you let a model grade anything. It documents specific cases where an AI reviewer's first guess was wrong in each direction — too strict, too lenient — alongside the corrected verdict and the reasoning. Feed a handful of these to whatever model you're using before asking it to judge your own evidence, so it calibrates against real judgment calls instead of guessing from the raw rules.
5. Run a self-assessment, then treat it as a readiness check, not an opinion
Point your AI tool at your own evidence — access logs, change-management tickets, vendor contracts — and have it walk one control at a time using the method files, the way AGENTS.md describes. What you get back is a gap list, not a SOC 2 report. Only a licensed CPA firm can issue the actual attestation; the repo is explicit that the framework and the product are two different things.
Example prompts you can copy
These follow the same one-control-at-a-time approach that worked best in my testing:
- "Read
framework/controls.jsonandframework/test_attributes.jsonfrom Chiaro's methodology repo. Summarize control CC6.1's test attributes and what evidence would satisfy each one." - "Here are three calibration examples from
calibration-examples.jsonwhere the model's first verdict was wrong. Apply the same corrected reasoning to this new piece of evidence: [paste evidence]." - "Using
method/type2-testing.md, tell me whether 'a sample of' means partial or complete population testing for this control, and cite the exact rule." - "Score this access-review evidence against test attribute TA-142's pass criteria. State a verdict and flag anything that would make a human auditor push back."
Specific citations to a control ID or file name get sharper answers than a general "check if we're SOC 2 ready" prompt — the repo is built to be queried attribute by attribute, not summarized in one shot.
Common mistakes to avoid
The first mistake I made was treating an AI's pass/fail verdict as equivalent to an auditor's opinion — the repo itself pushes back on this, and only a CPA firm can sign a real SOC 2 report. Second, skipping AGENTS.md and jumping straight into controls.json: the read order matters, because test attributes and evidence maps don't make sense without the control they're attached to. Third, assuming "for a sample of" in the control text means sample-based testing — method/type2-testing.md overrides the wording and defaults to complete-population testing, which the repo flags explicitly as a common misreading. Fourth, skipping the calibration examples entirely and going straight to grading real evidence, which is exactly how you inherit the same too-strict or too-lenient bias the 498 examples were built to correct. Fifth, forgetting that a zero-evidence result and a missing-evidence result aren't the same thing — the methodology treats "zero rows with a recorded pull" as a valid zero, not an automatic gap, and conflating the two produces false findings.
Chiaro's methodology vs. the alternatives
| Chiaro methodology (open source) | Drata / Vanta / Oneleet | Hiring an audit firm directly, no tooling | |
|---|---|---|---|
| Cost to read the methodology | Free, CC BY 4.0 | Not published; methodology is proprietary | Not published |
| Format | Machine-readable JSON + Markdown | Proprietary dashboards | Firm-specific, usually PDF checklists |
| Issues a real SOC 2 opinion | No — only Chiaro's CPA arm (or any licensed firm) can | Yes, paired with a partner CPA firm | Yes |
| Built for AI agents to read | Yes — ships an AGENTS.md file |
Not designed for this | No |
| Chiaro's platform subscription | $49/mo for a 1-5 person team, per Chiaro's pricing page | Typically quoted, often higher for small teams | N/A |
A Hacker News commenter who said they'd set up compliance automation with Drata, Vanta, and Oneleet over the past decade put the core pain point well: no matter which platform runs the checklist, "it's a huge pain grabbing screenshots." Chiaro's open-source SOC 2 methodology doesn't solve evidence collection — it solves not knowing what the auditor is actually testing for until you're already in the audit.
Tools that make this easier
If you're pointing an AI at this repo instead of just reading it yourself, how to use Claude AI and how to use Cursor AI cover the basics of getting either tool to read a cloned repo and follow file-based instructions like AGENTS.md. Since this is exactly the kind of small-team problem a solo founder or five-person startup runs into before a first enterprise deal, my best AI tool for small business roundup is a reasonable next stop for the rest of your compliance and ops stack. For a broader security angle on what AI tools do with your data before you hand them evidence, my look at scanning Hugging Face training data for leaked secrets is worth reading. And if budget is the blocker before you're ready to pay for any platform, free AI tools rounds up no-cost options, while how we test AI tools explains the standard I held this repo to.
My take
The open-source SOC 2 methodology itself is a genuinely useful, free resource — reading exactly what an ex-Deloitte auditor tests for, with worked examples of where AI graders get it wrong in both directions, is more transparency than most compliance vendors offer at any price. What I'd flag: this is the framework, not a finished audit tool, and the repo says so itself. You still need real evidence collection, a human who understands your actual systems, and — if you want the paper that gets you into an enterprise deal — a licensed CPA firm to sign it. Chiaro is betting that giving away the methodology builds enough trust that you'll pay for its $49/month platform and audit when you're ready. Whether that's a fair trade depends on whether you were going to pay a compliance vendor anyway; if you were, reading the actual rules first is strictly better than not.
Frequently Asked Questions
Is Chiaro's open-source SOC 2 methodology free?
Yes. The repository is licensed CC BY 4.0, so reading, cloning, and building on it costs nothing. Chiaro's paid platform, which operationalizes the methodology with monitoring and a real audit, is separate and starts at $49/month for a 1-5 person team.
Does using this methodology mean I'm SOC 2 compliant?
No. The repo is explicit that it's "the methodology, not the product." Only a licensed CPA firm can issue an actual SOC 2 opinion — this framework helps you self-assess and close gaps before that engagement, nothing more.
What is the easiest way to start with it?
Read AGENTS.md first, then trace one control through controls.json, test_attributes.json, and evidence_map.json before trying to grade real evidence. Feed your AI a few calibration examples before trusting its first verdict.
How is this different from Drata, Vanta, or Oneleet?
Those platforms automate evidence collection behind a paid dashboard without publishing their underlying test methodology. Chiaro published the methodology itself — 86 controls and 355 test attributes — for free, separate from its paid platform.
Can an AI model replace a real SOC 2 auditor?
No, and the repo says so directly. An AI reading this methodology can flag gaps and score evidence against the same criteria an auditor uses, but only a licensed CPA firm, like Chiaro's own Y Assurance PLLC, can sign the attestation that a real audit requires.