Menu
Quick answer: Comp AI does not publish a numeric rate card. Its quote depends on frameworks, company size, timeline, and whether audit, penetration testing, or trust-center work is included. Public terms set a 12-month minimum and annual renewal unless either party gives at least 30 days’ notice. Compare an itemized Order Form, not a retired online estimate.
| Public pricing fact | Current answer | Source checked 2026-08-11 |
|---|---|---|
| Numeric rate card | Unknown / not published | Comp AI pricing |
| Quote inputs | Frameworks, company size, timeline, audit and security needs | Comp AI pricing |
| Minimum commitment | 12 months, regardless of billing frequency | Comp AI terms |
| Renewal | Successive one-year periods unless either party gives at least 30 days’ written notice | Comp AI terms |
| Deal-specific price and scope | The signed Order Form | Comp AI terms |
Older third-party tier names, $199/month, $997/month, and $5,000–$10,000 figures do not establish Comp AI’s current price.
How much does Comp AI cost?
Comp AI is quote-only and publishes no current dollar range. Comp AI says your quote depends on frameworks, company size, deadline, and audit or security services. Budget from the amount in your Order Form for the agreed scope.
Comp AI says it will give you an exact number during a 20-minute pricing call. Do not budget from retired or third-party figures.
For broader market budgeting, use the SOC 2 software pricing comparison. For product fit and open-core trade-offs, use the full Comp AI review.
What changes a Comp AI quote?
Four documented inputs shape a Comp AI quote: frameworks, company size, timeline, and audit or security needs. Define all four before comparing proposals. Quotes are comparable only when the required work, services, and contract terms match.
- Frameworks in scope. Name every framework you need now or during the initial term, such as SOC 2, ISO 27001, HIPAA, or ISO 42001. Ask whether shared controls reduce the work and price, and which modules require the commercial Enterprise Edition.
- Company and system size. Headcount affects people, devices, and access reviews, but it does not describe your full technical scope. Give Comp AI your legal entities, cloud accounts, repositories, endpoints, vendors, and other systems.
- Timeline. A short audit-readiness sprint requires a different rollout from a quarter-long program. Record the readiness target, observation-period start, fieldwork window, and report deadline separately. Readiness is not report issuance.
- Audit and security needs. Comp AI says the audit, penetration testing, and a trust center can change what is included. Mark each one as included, separate, or not required in the proposal.
Also itemize implementation, support, questionnaires, custom integrations, migration, and renewal pricing.
Are the SOC 2 audit and penetration test included?
Comp AI says audit and penetration-testing needs can affect the quote, but its public pricing page does not say either service comes with every proposal. Get the provider, deliverables, exclusions, timeline, and fee for each service in writing before treating a bundled total as complete.
A licensed CPA firm must perform the SOC 2 examination and issue the report. See who performs and signs the SOC 2 report when evaluating an end-to-end scope. If Comp AI coordinates or bundles that work, require the Order Form to identify the CPA firm, engagement type, Trust Services Categories, observation period, report, and fee.
For a penetration test, require the provider, method, in-scope applications, APIs, cloud assets or networks, authenticated access, retest, report, and delivery date. A scan and a full external penetration test are not interchangeable.
Use the SOC 2 audit cost guide to scope the separate audit budget. It does not replace the named firm and fee in the Comp AI proposal.
What public Comp AI contract terms apply?
Comp AI’s January 2026 standard terms set a minimum 12-month commitment, non-cancelable and non-refundable fees except where the agreement or law says otherwise, and automatic one-year renewals with a 30-day notice window. Your Order Form states the actual fees, payment schedule, start date, and term.
| Contract field | Public standard term | Buyer action |
|---|---|---|
| Commitment | Minimum 12 months, even with monthly or quarterly billing | Do not read monthly billing as month-to-month cancellation |
| Fees | U.S. dollars; non-cancelable and non-refundable except as stated | Identify every exception, credit, and termination remedy |
| Renewal | Automatic one-year renewal | Put the notice date and delivery method on your calendar |
| Non-renewal notice | At least 30 days before term end | Set an earlier internal reminder and get written acknowledgement |
| Data after termination | Deleted within 30 days unless return is requested or law requires retention | Define export format, timing, assistance, and deletion evidence |
Read the Order Form, standard terms, service-level agreement, data-processing agreement, and amendments together.
Does self-hosting make Comp AI free?
A self-hosted Comp AI deployment still carries software, infrastructure, and operating costs. Comp AI’s repository describes a 99% AGPLv3 core and a commercially licensed /ee Enterprise Edition. The Docker guide also calls for third-party services, deployment work, security controls, monitoring, maintenance, and an accountable engineering owner.
Compare the same licence, deployment, and operating costs across the qualified self-hosted SOC 2 compliance tools.
The Docker self-hosting guide requires Docker, an external PostgreSQL 14+ database with SSL, a Resend account for transactional email, and a Trigger.dev account for background workflows. Production guidance adds HTTPS through a reverse proxy, strong secrets and rotation, database network restrictions, Docker disk monitoring, migrations, logs, and deployment of workflow tasks.
Price four layers before comparing self-hosting with the managed quote:
- Software licence. Confirm which required features, support, and deployment rights sit in commercial
/ee. - Infrastructure. Price compute, PostgreSQL, storage, email, Trigger.dev, domains, TLS, logging, and observability.
- Engineering operations. Assign upgrades, migrations, backups, restoration tests, monitoring, vulnerability response, and incidents.
- Compliance work. Self-hosting does not remediate controls, perform a penetration test, or issue a SOC 2 report.
Include engineering time in the comparison. If an Enterprise Edition feature or self-hosted support term is undocumented, mark it unknown and ask for a price.
How do managed and self-hosted Comp AI compare?
Managed Comp AI puts the infrastructure with the vendor; self-hosting gives you deployment control and the operating responsibility that comes with it. Public sources do not establish feature, support, or recovery parity. Ask Comp AI to resolve each unknown in the quote.
| Decision field | Managed Comp AI | Self-hosted Comp AI |
|---|---|---|
| Commercial price | Quote-only | Public core is AGPLv3; /ee price and rights unknown |
| Deployment control | Vendor-operated service; confirm hosting and residency | You control deployment and data location |
| Required services | Ask Comp AI to itemize them | Docker, PostgreSQL 14+ with SSL, Resend, Trigger.dev, HTTPS |
| Feature scope | Confirm edition, limits, and add-ons | Confirm public-core versus /ee boundaries |
| Maintenance and security | Confirm SLA, patching, monitoring, and incident duties | You assign patching, monitoring, secrets, network controls, and response |
| Backups and recovery | Confirm retention, recovery objectives, and tests | You design, fund, and test recovery |
| Support | Standard terms describe email and Slack support; confirm response commitments | Community or commercial support unknown until quoted |
| Offboarding | Define export, assistance, and deletion under the contract | You plan export, migration, key rotation, and service shutdown |
What belongs in a Comp AI Order Form?
An itemized Comp AI Order Form separates one bundled total into comparable line items. Send the same checklist to every shortlisted platform. Compare totals only after the framework scope, systems, services, term, and deliverables match.
Copy this into the pricing request:
Please itemize the Comp AI proposal for:
1. Platform edition and deployment: managed, AGPLv3 core, and any /ee rights
2. Users, employees, legal entities, devices, and usage or overage limits
3. Frameworks included now and the price of adding each framework later
4. Required integrations, evidence depth, custom work, and unsupported systems
5. Implementation tasks, owner, completion criteria, timeline, and one-time fee
6. Support channels, response commitments, named contact, and escalation path
7. Trust-center scope, hosting, custom domain, approvals, and access workflows
8. Questionnaire volume, automation, review owner, and usage limits
9. SOC 2 CPA firm, engagement type, scope, fieldwork, report, and separate fee
10. Penetration-test provider, scope, method, retest, report, date, and fee
11. Initial term, billing frequency, payment dates, taxes, and price protection
12. Renewal term, notice deadline, notice method, and renewal-price cap
13. Termination rights, refunds or credits, suspension, and scope-reduction terms
14. Data export format, assistance, return deadline, deletion, and proof of deletion
15. Self-hosted infrastructure, upgrades, backups, recovery, monitoring, and support
Ask Comp AI to label every line included, add-on, usage-limited, customer-owned, unavailable, or unknown. Do not treat an unanswered line as included or free.
Comp AI pricing FAQ
How much does Comp AI cost?
Comp AI does not publish a current numeric rate card. Comp AI says a quote depends on frameworks, company size, timeline, and whether audit, penetration-testing, or trust-center work is included. Standard terms set a 12-month minimum; the Order Form states the actual fees and scope.
Does Comp AI offer monthly pricing?
Comp AI’s standard terms allow monthly, quarterly, or annual billing, but every option carries at least a 12-month commitment. Monthly billing is not a month-to-month contract and does not let you cancel after one month.
Does Comp AI pricing include the SOC 2 audit?
Comp AI says audit needs affect the quote, but its public pricing page does not show that every quote includes an audit. A licensed CPA firm performs the examination and issues the SOC 2 report. Require the Order Form to name the licensed CPA firm, deliverables, exclusions, and fee.
Is penetration testing included in Comp AI pricing?
Comp AI says penetration-testing needs affect the quote, but its public pricing page does not say every quote includes a test. Require the Order Form to name the provider, test type, in-scope assets, retest, report, delivery date, and any separate fee.
Is self-hosted Comp AI free?
Self-hosted Comp AI still has software, infrastructure, and operating costs. The repository describes a 99% AGPLv3 core and a commercially licensed Enterprise Edition, while the deployment guide requires Docker, PostgreSQL, email, Trigger.dev, HTTPS, monitoring, maintenance, and engineering ownership.
What should be in a Comp AI Order Form?
Your Comp AI Order Form should itemize the platform edition, users, frameworks, integrations, implementation, support, trust center, questionnaires, CPA audit provider and fee, penetration test, billing, renewal, termination, data return or deletion, and self-hosted Enterprise Edition rights.
What should a Comp AI buyer do next?
Send the checklist to Comp AI and ask for an itemized quote. Read the Comp AI review for product fit and the Comp AI software record for the sourced product facts before your pricing call.
If the quote includes audit work, ask the named CPA firm to confirm the engagement. If self-hosting remains on your shortlist, get engineering and security approval for the /ee boundary, recovery plan, support model, and operating budget.