Menu
Comp AI
Comp AI is an open-core compliance automation platform for SOC 2 and other frameworks. The hosted product covers evidence, questionnaires, audits, and penetration testing; its public repository exposes the core platform and hundreds of integrations.
Best for: Engineering-led teams that value inspectable code or the option to self-hostWatch for: No published rate card, and managed-cloud enterprise controls do not follow from the open-core codebase Read our Comp AI review →
AI and MCP
MCP server: Official. Access: Read, write and delete. Checked 12 Oct 2026.
What does Comp AI do?
Comp AI was founded in 2025. Comp AI is led by Lewis Carhart. Comp AI says it serves more than 1,000 companies globally.
Evidence collection
Available · Product documentation describes recurring connected evidence and task-specific agents that buyers test and publish.
Scope and limits
Product documentation describes recurring connected evidence and task-specific agents that buyers test and publish. The public task-automation execution and publishing actions require an enterprise API secret; this commercial boundary does not establish that built-in integration checks or all AI features require that licence.
Auditor workspace
Partial · The public API documents audit-ready evidence exports, audit findings, remediation status, and supporting evidence.
Scope and limits
The public API documents audit-ready evidence exports, audit findings, remediation status, and supporting evidence. Public documentation does not establish every auditor permission or organization-level visibility boundary.
Trust center
Available · A live Comp AI Trust Center exposes compliance status, policies, controls, subprocessors, and a questionnaire access path.
Security questionnaires
Available · Current product documentation describes questionnaire upload, answer drafting from approved material, review, and export workflows.
Enterprise administration
Partial · The security page documents custom roles, fine-grained role-based permissions, and audit logging.
Scope and limits
The security page documents custom roles, fine-grained role-based permissions, and audit logging. The public documentation index does not establish SCIM.
Continuous control testing
Available · Integration checks run automatically after connection and daily on a schedule; separate cloud-test and device-agent documentation describes continuous cloud and endpoint monitoring.
Multi-framework support
Partial · The pricing page says controls map across frameworks and describes adding ISO 27001 to an existing SOC 2 program as starting about two-thirds complete.
Scope and limits
The pricing page says controls map across frameworks and describes adding ISO 27001 to an existing SOC 2 program as starting about two-thirds complete. This is a vendor description of cross-framework reuse.
Funding history
Comp AI announced a $34 million Series A led by Roo Capital and Grand Ventures on September 17, 2026, following its $2.6 million pre-seed round announced in July 2025.
Code and licence boundary: The repository declares an AGPLv3 core and a commercially licensed /ee Enterprise Edition. Its September 23 public task-automation source requires an enterprise API secret for execution and publishing and explicitly rejects a missing secret as requiring an enterprise licence. This establishes a boundary for those task-automation actions, not every AI feature or built-in integration check. Managed-cloud pricing is quote-only. Repository source.
How much does Comp AI cost?
Comp AI does not publish prices. Your price depends on plan scope, headcount, services, and contract term. Read the Comp AI pricing guide.
Price source: view reported prices · checked 2026-09-24
Comp AI's standard terms state a 12-month minimum and automatic one-year renewals unless either party gives 30 days' written notice; check the signed Order Form for the fee and scope. Standard terms
Ask for the first-year total, renewal cap, implementation charge, required add-ons, and separate audit fee in writing.
How does Comp AI compare with Scytale, Vanta, Drata?
| Attribute | Comp AIThis profile | Scytale | Vanta | Drata |
|---|---|---|---|---|
| Best for | Engineering-led teams that value inspectable code or the option to self-host | Companies without compliance expertise seeking software plus hands-on advisory | Cloud-native SaaS teams on mainstream stacks that value a broad integration catalog | Growth-stage SaaS teams on mainstream stacks that expect to add frameworks over time |
| Observed price | Not published | $7,500 / year | $7,500–$57,207 / year | $9,415–$68,250 / year |
| G2 rating | 4.7/5 (73 reviews) | 4.8/5 (734 reviews) | 4.6/5 (2,728 reviews) | 4.7/5 (1,397 reviews) |
| Integrations | 590+ published | 150+ published | 400+ published | 300+ published |
| Frameworks | 11 listed | 9 listed | 8 listed | 10 listed |
| Onboarding | guided | bundled expert | guided | guided |
| Auditors here | 4 | Not published | 36 | 45 |
| Trust center | Listed | Listed | Listed | Listed |
Will Comp AI connect to your stack?
Comp AI reports 590+ integrations. Check the exact fields, tests, permissions, and plan coverage for each tool you need.
Check 30 named tools
| Tool | Coverage | Scope |
|---|---|---|
| AWS | Listed integration | The dedicated cloud-test guide documents a direct account connection and security checks; exact service coverage and required permissions vary by cloud. Source |
| Google Cloud | Listed integration | The dedicated cloud-test guide documents a direct account connection and security checks; exact service coverage and required permissions vary by cloud. Source |
| Microsoft Azure | Listed integration | The dedicated cloud-test guide documents a direct account connection and security checks; exact service coverage and required permissions vary by cloud. Source |
| Okta | Listed integration | The connector definition documents its authentication setup and named compliance checks; plan availability and evidence depth may vary. Source |
| Microsoft Entra ID | Listed integration | The connector definition documents its authentication setup and named compliance checks; plan availability and evidence depth may vary. Source |
| Google Workspace | Listed integration | The connector definition documents its authentication setup and named compliance checks; plan availability and evidence depth may vary. Source |
| Microsoft 365 | Listed integration | The connector definition documents its authentication setup and named compliance checks; plan availability and evidence depth may vary. Source |
| GitHub | Listed integration | The connector definition documents its authentication setup and named compliance checks; plan availability and evidence depth may vary. Source |
| GitLab | Listed integration | The connector definition documents its authentication setup and named compliance checks; plan availability and evidence depth may vary. Source |
| Jira | Listed integration | The connector definition documents its authentication setup and named compliance checks; plan availability and evidence depth may vary. Source |
| Linear | Listed integration | The connector definition documents its authentication setup and named compliance checks; plan availability and evidence depth may vary. Source |
| Slack | Listed integration | The connector definition documents its authentication setup and named compliance checks; plan availability and evidence depth may vary. Source |
| Rippling | Listed integration | The connector definition documents its authentication setup and named compliance checks; plan availability and evidence depth may vary. Source |
| Gusto | Listed integration | The connector definition documents its authentication setup and named compliance checks; plan availability and evidence depth may vary. Source |
| BambooHR | Listed integration | The connector definition documents its authentication setup and named compliance checks; plan availability and evidence depth may vary. Source |
| Deel | Listed integration | The connector definition documents its authentication setup and named compliance checks; plan availability and evidence depth may vary. Source |
| CrowdStrike | Listed integration | The connector definition documents its authentication setup and named compliance checks; plan availability and evidence depth may vary. Source |
| Kandji | Listed integration | The connector definition documents its authentication setup and named compliance checks; plan availability and evidence depth may vary. Source |
| Jamf | Listed integration | The connector definition documents its authentication setup and named compliance checks; plan availability and evidence depth may vary. Source |
| Microsoft Intune | Listed integration | The connector definition documents its authentication setup and named compliance checks; plan availability and evidence depth may vary. Source |
| Datadog | Listed integration | The connector definition documents its authentication setup and named compliance checks; plan availability and evidence depth may vary. Source |
| Snyk | Listed integration | The connector definition documents its authentication setup and named compliance checks; plan availability and evidence depth may vary. Source |
| Cloudflare | Listed integration | The connector definition documents its authentication setup and named compliance checks; plan availability and evidence depth may vary. Source |
| Salesforce | Listed integration | The connector definition documents its authentication setup and named compliance checks; plan availability and evidence depth may vary. Source |
| HubSpot | Listed integration | The connector definition documents its authentication setup and named compliance checks; plan availability and evidence depth may vary. Source |
| 1Password | Listed integration | The connector definition documents its authentication setup and named compliance checks; plan availability and evidence depth may vary. Source |
| JumpCloud | Listed integration | The connector definition documents its authentication setup and named compliance checks; plan availability and evidence depth may vary. Source |
| Workday | Listed integration | The connector definition documents its authentication setup and named compliance checks; plan availability and evidence depth may vary. Source |
| ServiceNow | Listed integration | The connector definition documents its authentication setup and named compliance checks; plan availability and evidence depth may vary. Source |
| Wiz | Listed integration | The connector definition documents its authentication setup and named compliance checks; plan availability and evidence depth may vary. Source |
Which frameworks does Comp AI support?
- SOC 2Comp AI says
- ISO 27001Comp AI says
- HIPAAComp AI says
- GDPRComp AI says
- PCI DSSComp AI says
- SOC 1Comp AI says
- FedRAMPComp AI says
- ISO 42001Comp AI says
- ISO 9001Comp AI says
- CCPAComp AI says
- NEN 7510Comp AI says
Some frameworks use mapped controls rather than native workflows. Confirm the tests and evidence required for each program.
Who does what in a SOC 2 with Comp AI?
Comp AI
Organizes the listed control, evidence, and audit workflows.
Your team
Owns policies, control decisions, exceptions, and approval of shared evidence.
The CPA firm
Sets audit scope, tests controls independently, and issues the SOC 2 report.
Comp AI does not issue the SOC 2 report. Its FAQ says customers may bring any accredited auditor, while current API docs document a built-in auditor role, auditor-only bulk evidence export, and finding/revision workflows. Comp AI also markets access to pre-vetted auditors, but no specific audit firm is named in the current product or pricing materials; confirm the legal CPA firm and fee in the quote.
Which auditors work with Comp AI?
4 licensed audit firms in our directory list Comp AI experience. Listing experience is not an endorsement.
| Firm | Licence | Peer review |
|---|---|---|
| 360 AdvancedPublished Type 2 fee: $10,000–$80,000 | Licensed CPA | Pass |
| ThoropassPublished Type 2 fee: $12,000–$85,000 | Licensed CPA | Pass |
| Zero Day CPAPublished Type 2 fee: $7,000–$10,000 | Licensed CPA | Review accepted, rating not public |
Questions to ask in a Comp AI demo
- Which parts of the auditor workspace require another tool or service?
- Which parts of enterprise administration require another tool or service?
- Can you demonstrate SCIM provisioning in the product?
- Which parts of native multi-framework support require another tool or service?
- Which plan includes SCIM, and is it a paid add-on?
- What is the first-year total, including onboarding, add-ons, and the audit fee?
- What renewal increase and minimum contract term should we put in writing?
- Is the SOC 2 audit contracted with a separate CPA firm, and what does that firm charge?
Comp AI FAQ
Where is Comp AI based?
Comp AI is headquartered in Miami, Florida, United States.
Who runs Comp AI?
Lewis Carhart is the CEO of Comp AI.
Who founded Comp AI?
Lewis Carhart and Claudio Fuentes and Mariano Fuentes founded Comp AI in 2025.
Does Comp AI include the SOC 2 audit?
Comp AI does not issue the SOC 2 report. Its FAQ says customers may bring any accredited auditor, while current API docs document a built-in auditor role, auditor-only bulk evidence export, and finding/revision workflows. Comp AI also markets access to pre-vetted auditors, but no specific audit firm is named in the current product or pricing materials; confirm the legal CPA firm and fee in the quote. A licensed CPA firm issues the SOC 2 report.
Is Comp AI itself SOC 2 compliant?
Supporting a buyer's SOC 2 program does not establish that Comp AI holds a current SOC 2 report. Ask for the vendor's current report during security review.
What does Comp AI integrate with?
Comp AI reports 590+ integrations. Confirm the fields, tests, permissions, and plan coverage for your own tools.
Similar platforms
Also listed as alternatives on G2: Vanta, Sprinto, Drata, Scrut Automation, Scytale, Secureframe. Observed 2026-09-24; the source controls its own ordering.
Comp AI on SOC2Auditors
Sources 49 records · last read 2026-09-30
These links show what we checked and when.
| Establishes | Source | Retrieved |
|---|---|---|
| Pinned September 23 source requires an enterprise API secret for task-automation execution and publishing. The missing-secret error requires an enterprise licence; this does not establish a paid boundary for every AI feature or built-in integration check. | Comp AI public repository Vendor docs | 2026-09-30 |
| Frameworks, product positioning, 580+ integrations, 1,000+ companies, evidence automation, cloud and device monitoring, guided Slack support, and auditor-agnostic positioning. | Vendor site Vendor docs | 2026-09-24 |
| Quote-only pricing factors, named frameworks, cross-framework control mapping, audit and penetration-test scope, and money-back-guarantee marketing. | Comp AI Vendor docs | 2026-09-24 |
| Custom roles, fine-grained access controls, audit logging, encryption, isolation, backups, and security practices. | Comp AI Vendor docs | 2026-09-24 |
| Live trust center with compliance status, policies, controls, subprocessors, and questionnaire access. | Comp AI Trust Center Vendor docs | 2026-09-24 |
| Public documentation index for Comp AI product workflows and integrations. | Comp AI documentation Vendor docs | 2026-09-24 |
| Recurring evidence collection from connected systems for SOC 2, ISO 27001, HIPAA, and GDPR. | Comp AI documentation Vendor docs | 2026-09-24 |
| Security-questionnaire upload, answer drafting, review, and export workflow. | Comp AI documentation Vendor docs | 2026-09-24 |
| Integration authentication, check execution, task mapping, connection flow, and daily scheduled checks. | Comp AI documentation Vendor docs | 2026-09-24 |
| Public API coverage for evidence, policies, questionnaires, trust access, frameworks, cloud checks, findings, and audit-ready exports. | Comp AI documentation Vendor docs | 2026-09-24 |
| Statement of Applicability create, auto-fill, review, approval, and export workflow. | Comp AI documentation Vendor docs | 2026-09-24 |
| Current Docker Compose self-hosting path and buyer-operated infrastructure dependencies. | Comp AI documentation Vendor docs | 2026-09-24 |
| Active open-core repository, AGPLv3/commercial licence boundary, releases, and self-hosting code. | Comp AI GitHub repository Vendor docs | 2026-09-24 |
| Public catalog summary: 590 connector definitions across nine categories, generated August 9, 2026. | Comp AI GitHub repository Vendor docs | 2026-09-24 |
| Vendor-described SOC 2 readiness and audit timeline boundaries. | Comp AI Vendor docs | 2026-09-24 |
| Bubba AI, Inc. legal identity, supported-framework wording, fees in the Order Form, 12-month minimum term, and renewal terms. | Comp AI Vendor docs | 2026-09-24 |
| September 2026 Series A, 2025 founding, headquarters, customer count, and expansion into continuous cybersecurity. | Comp AI Vendor docs | 2026-09-24 |
| Current 4.7-star rating across 73 reviews, serving customers since 2025, and reviewer distribution. | G2 Review platform | 2026-09-24 |
| Current co-considered alternatives shown for Comp AI. | G2 Review platform | 2026-09-24 |
| Direct AWS cloud connection, authentication, scan scope, and compliance-check documentation. | Comp AI documentation Vendor docs | 2026-09-24 |
| Direct GCP cloud connection, authentication, scan scope, and compliance-check documentation. | Comp AI documentation Vendor docs | 2026-09-24 |
| Direct AZURE cloud connection, authentication, scan scope, and compliance-check documentation. | Comp AI documentation Vendor docs | 2026-09-24 |
| Direct Okta connector definition with authentication setup and named compliance checks. | Comp AI GitHub repository Vendor docs | 2026-09-24 |
| Direct Microsoft Entra ID connector definition with authentication setup and named compliance checks. | Comp AI GitHub repository Vendor docs | 2026-09-24 |
| Direct Google Workspace connector definition with authentication setup and named compliance checks. | Comp AI GitHub repository Vendor docs | 2026-09-24 |
| Direct Microsoft 365 connector definition with authentication setup and named compliance checks. | Comp AI GitHub repository Vendor docs | 2026-09-24 |
| Direct GitHub connector definition with authentication setup and named compliance checks. | Comp AI GitHub repository Vendor docs | 2026-09-24 |
| Direct GitLab connector definition with authentication setup and named compliance checks. | Comp AI GitHub repository Vendor docs | 2026-09-24 |
| Direct Jira connector definition with authentication setup and named compliance checks. | Comp AI GitHub repository Vendor docs | 2026-09-24 |
| Direct Linear connector definition with authentication setup and named compliance checks. | Comp AI GitHub repository Vendor docs | 2026-09-24 |
| Direct Slack connector definition with authentication setup and named compliance checks. | Comp AI GitHub repository Vendor docs | 2026-09-24 |
| Direct Rippling connector definition with authentication setup and named compliance checks. | Comp AI GitHub repository Vendor docs | 2026-09-24 |
| Direct Gusto connector definition with authentication setup and named compliance checks. | Comp AI GitHub repository Vendor docs | 2026-09-24 |
| Direct BambooHR connector definition with authentication setup and named compliance checks. | Comp AI GitHub repository Vendor docs | 2026-09-24 |
| Direct Deel connector definition with authentication setup and named compliance checks. | Comp AI GitHub repository Vendor docs | 2026-09-24 |
| Direct CrowdStrike connector definition with authentication setup and named compliance checks. | Comp AI GitHub repository Vendor docs | 2026-09-24 |
| Direct Kandji connector definition with authentication setup and named compliance checks. | Comp AI GitHub repository Vendor docs | 2026-09-24 |
| Direct Jamf connector definition with authentication setup and named compliance checks. | Comp AI GitHub repository Vendor docs | 2026-09-24 |
| Direct Microsoft Intune connector definition with authentication setup and named compliance checks. | Comp AI GitHub repository Vendor docs | 2026-09-24 |
| Direct Datadog connector definition with authentication setup and named compliance checks. | Comp AI GitHub repository Vendor docs | 2026-09-24 |
| Direct Snyk connector definition with authentication setup and named compliance checks. | Comp AI GitHub repository Vendor docs | 2026-09-24 |
| Direct Cloudflare connector definition with authentication setup and named compliance checks. | Comp AI GitHub repository Vendor docs | 2026-09-24 |
| Direct Salesforce connector definition with authentication setup and named compliance checks. | Comp AI GitHub repository Vendor docs | 2026-09-24 |
| Direct HubSpot connector definition with authentication setup and named compliance checks. | Comp AI GitHub repository Vendor docs | 2026-09-24 |
| Direct 1Password connector definition with authentication setup and named compliance checks. | Comp AI GitHub repository Vendor docs | 2026-09-24 |
| Direct JumpCloud connector definition with authentication setup and named compliance checks. | Comp AI GitHub repository Vendor docs | 2026-09-24 |
| Direct Workday connector definition with authentication setup and named compliance checks. | Comp AI GitHub repository Vendor docs | 2026-09-24 |
| Direct ServiceNow connector definition with authentication setup and named compliance checks. | Comp AI GitHub repository Vendor docs | 2026-09-24 |
| Direct Wiz connector definition with authentication setup and named compliance checks. | Comp AI GitHub repository Vendor docs | 2026-09-24 |