Menu
On this page
OneTrust publishes no dollar price for a SOC 2 compliance program. It sells Tech Risk & Compliance (TRC) as a solution package priced by usage meters, such as admin users and the size of the inventory the package manages, and quotes each buyer through sales. The UK catalogue price for the retired Certification Automation module is a historical data point, not a TRC price.
This guide covers OneTrust’s compliance product for a SOC 2 program, not its consent or privacy products. OneTrust has retired Certification Automation; the OneTrust review has the renewal, support and extraction dates and the migration gaps. A buyer choosing a SOC 2 platform from scratch should start with our guide to how to choose SOC 2 compliance software.
How does OneTrust price Tech Risk & Compliance?
OneTrust prices Tech Risk & Compliance as a solution package with usage meters, and publishes no dollar amount. OneTrust’s pricing page describes tiered packages and sends buyers to sales. Its help-center article on solution packaging and usage meters, dated August 22, 2025, says packages have been sold this way since the Spring 2025 release, with meters applied to the whole package instead of to each product.
For TRC the article’s example meters are the number of admin users and the size of the inventory the solution manages (assets, third parties or AI projects, for example). A customer can switch on every capability in a package without an extra licence, within the meter limits. Going past licensed usage may need a contract amendment or an upgrade. The thresholds sit on a usage-terms page that requires a login, so the numbers that set your price are in the proposal, not on a public page.
OneTrust’s pricing page splits its packages into two meter families. Risk and compliance packages such as TRC are metered on admin users and inventory size, while consent and data-use packages are metered on data profiles, visitors or data volume. A consent price, which several pricing guides quote, does not price a SOC 2 compliance program.
Existing module customers move to a package through their account executive, renewal manager or customer success manager, who prepares a customized proposal. Major new features will only be offered in solution packages.
What did the UK catalogue list for Certification Automation?
On September 29, 2026, the UK G-Cloud 14 listing showed Certification Automation at £36,180 per licence per year. That figure prices a module OneTrust no longer sells, per licence, so it does not convert into a TRC quote based on admin users and inventory. The OneTrust review covers the listing and what it does and does not show.
What should a migrating customer get priced in writing?
Ask for an itemized TRC order that answers each line below. OneTrust’s migration guide, dated July 1, 2026, names TRC as the destination. It does not promise feature parity or a transfer of every record.
| Quote line | Written question |
|---|---|
| Package and scope | Which TRC package and capabilities are included, and do they cover the SOC 2 workflows and frameworks you use today? |
| Meter thresholds | What counts as an admin user and as inventory, what are the limits at signing, and how many of your assets, vendors or systems already count? |
| Overage | What happens past a limit: contract amendment, upgrade, or a per-unit charge, and at what price? |
| Migration work | Who exports and recreates what the guide does not migrate, and is that labor in the order or billed separately? Price it before you sign; the OneTrust review lists the gaps. |
| Access to the old module | What are this account’s subscription end date, extraction window and support end date, and does the CPA keep access until the audit closes? |
| Term and renewal | What price, scope and notice period apply after the first term, and is there a cap on increases? |
| CPA audit | Is the independent CPA’s fee in the order, or contracted separately? |
Should a new SOC 2 buyer shortlist OneTrust?
A new buyer cannot buy Certification Automation, and OneTrust gives no public TRC price to compare. Ask OneTrust to demonstrate TRC on your SOC 2 workflow and to put the package, meters and overage terms in writing. Then compare it with platforms that have public pricing guides, such as Vanta and Drata, and with the contract ranges in our SOC 2 software pricing comparison. Keep software, implementation labor and the audit fee as separate budget lines.
More in Compliance Tools