SOC 2 evidence folder — policies we could actually follow

Wrote access-control, incident, and vendor policies in plain English and sat with engineering for two working sessions. Auditor accepted the pack in 2021.