Customer story
Northwind Treasury — How a fintech team wired GitHub, CI, and on-call into the PCI / SOC 2 audit trail.
deployment 2026-08-04 · ~900K LOC monorepo
logo placeholder · no customer asset shipped yet
The team
Who Northwind Treasury is, and what they own.
Northwind Treasury is a mid-market corporate-treasury platform. One TypeScript and Rust monorepo serves the core-banking API, the partner integration surface, and a ledger reconciliation engine out of a single workspace. Payments customers are mid-cap corporate treasurers, and their regulator asks for PCI and SOC 2 evidence rows on every change to a settlement path or a partner integration: a change-author chain, a signature, an SBOM hash, a sandbox-run hash, and a verifier the platform team's own auditor can replay without trusting Driftlock's control plane.
Team shape
Eight engineers in two regions; one staff engineer plus a rotating platform lead; the rest split across settlement paths, partner connectors, and ledger surfaces.
Monorepo shape
One pnpm workspace, one Bazel cache, one protected main branch, and one GitHub App identity; ~40 PRs a week merged, roughly half cross a dependency boundary.
Compliance shape
PCI-DSS in scope and SOC 2 Type II in evidence; the PCI evidence pack is quarterly, the SOC 2 window lands two months later; each pack asks for the per-PR row as a standalone evidence artefact.
Before Driftlock
What the week looked like before the watcher ran.
Before Driftlock, an overnight Dependabot or RustSec advisory opened, and the on-call staff engineer woke, read the advisory, drafted a remediation PR by hand, waited for CI, and self-reviewed their own diff at 03:00. If the advisory hit a settlement path, the same engineer also had to record the seven per-PR fields by hand in the PCI spreadsheet; the spreadsheet was usually two advisories behind by morning, and a parallel copy sat in the SOC 2 evidence vault with no link between them. Late-night triage was the rule, not the exception.
When the TypeScript toolchain, the Rust toolchain, or a partner SDK moved forward, the team ran a separate upgrade sprint: re-pin the lockfile, re-run the heavy validation suites, re-emit SBOMs by hand, and stitch the audit records into both spreadsheets after the fact. Each sprint cost a week of one engineer and shipped zero partner-facing PRs; the gap between the regulator's evidence row and the team's own PR was wide enough that the auditor had learned to ask the easy question and skip the hard one.
Implementation
How the wiring landed in a week.
Driftlock shipped into Northwind's monorepo as a single Helm + Terraform deployment inside the team's existing EKS cluster, behind the same egress policy as the core-banking service. The platform lead pointed the watcher at the same four signal surfaces, onboarded the cosign key on their KMS, and let the sandbox mount the monorepo's Bazel cache so reruns reused their own test evidence. The rollout week ended with the platform lead, the compliance lead, and the PCI auditor replaying one PR together — the auditor opened the run id, verified the cosign signature, diffed the SBOM hash against the lockfile, and asked one follow-up about a test fixture.
- GitHub App installSame GitHub App identity that opens PRs today; no new identity introduced, no shared credentials moved.
- CI identityBound to the existing CI identity via OIDC; the sandbox reuses the same token so a reviewer sees a single sign-off line.
- On-call pager ingestionThe watcher reads the team's PagerDuty webhook and turns each overnight incident into a Triage-verdict PR; severity-3 incidents auto-merge on a second reviewer sign-off.
- Monorepo upgrade pinA pinned subscription on the Rust, TypeScript, and partner-SDK advisories; the watcher opens one upgrade PR per release line and pins the lockfile in the same commit.
- Signing-key onboardingThe customer KMS-resident cosign key onboarded on day one; rotation runs on the platform's quarterly cadence; Rekor claim payloads keep older signatures verifiable across rotations.
What changed
Three numbers the regulator and the platform team now share.
Each number has a stated unit — the same tone discipline the comparison and governance pages use, so a reader cross-checking the stats against the rest of the site reads the same shape.
Mean time to merge dependency advisories
4.2 hours
From a Dependabot or RustSec advisory opening to a merged, signed PR — down from roughly 16 hours when one staff engineer picked it up overnight.
Weekly PRs shipped without human triage
14 PRs / week
Rust, TypeScript, and partner-SDK upgrade PRs the watcher opens and the platform team approves in batch; previously cost a week of one engineer per quarter.
Audit questions answered in a single click
93 %
Of the PCI and SOC 2 evidence-pack questions answered by replaying the run id against the team's own storage tier — no Driftlock-managed control plane in the loop.
In the engineer's words
“Before Driftlock, our PCI and SOC 2 evidence rows lived in two separate spreadsheets, and the gap between a merge and the audit row was usually a week of a platform engineer's time. With Driftlock the auditor opens the run id, replays the sandbox, and the SBOM hash is the lockfile diff — the spreadsheets quietly became a thin UI on top of the per-PR record, and the gap closed itself.”
Staff Engineer · Northwind Treasury
fictional placeholder attribution · swap with the named customer before launch
See it on your stack
Run the same trial against one of your real monorepos.
Driftlock ships into your VPC, points at two of your existing watchlist surfaces for ten days, and signs every audit-linked PR with your cosign key in your KMS. The trial ends with a walkthrough of the same per-PR record the regulator replays here.