We’ve been sharing how we build Amp with Amp, orbs, and no pull requests, and the most common reaction is “Wait, you don’t use PRs? How is that possible?” That question came up when we considered SOC 2 compliance. Our auditors didn’t ask for PRs; they asked about our change process and helped design controls that fit our workflow.

SOC 2 doesn’t require pull requests; it requires that you assess risks and implement appropriate controls. We chose restricted push access, signed commits with verified GitHub signatures, and automated CI that blocks bad changes before they reach main. An audit trail linking each commit to its discussion thread provides the same verification a PR would.

Because Amp is a small, high‑trust team of about 20 engineers, we can ship continuously without a heavy process. Scaling isn’t about forcing every change through PRs; it’s about thinking about the risks each system carries and applying controls proportional to those risks. The answer isn’t pull requests, but a deliberate, documented process that satisfies auditors and lets us deliver fast.