Menu
Iru
Iru, formerly Kandji, combines SOC 2 compliance automation and device management on one platform. Compliance Automation maps device, identity, and connected-system evidence to controls, and an independent CPA issues the SOC 2 report.
Rebranded from Kandji to Iru on October 22, 2025 (company newsroom).
Best for: Teams seeking SOC 2 automation and device management in one platformWatch for: Young compliance module; no advertised native vendor-risk, supplier-assessment, or risk-scoring workflow as of Sept 2026 Read our Iru review →
AI and MCP
MCP server: No official server for compliance data documented. Checked 12 Oct 2026.
What does Iru do?
Iru was founded in 2018. Iru is led by Adam Pettit. Iru says it serves 6,000+ companies.
Evidence collection
Available · Iru says Adaptive integrations collect artifacts, validate relevance and staleness, and map evidence to controls.
Scope and limits
Iru says Adaptive integrations collect artifacts, validate relevance and staleness, and map evidence to controls. Native Iru endpoint and identity telemetry can also supply evidence.
Auditor workspace
Available · Auditor and Compliance Auditor can view control actions and artifacts, generate automated artifacts, assess relevance, and manage comments.
Scope and limits
Auditor and Compliance Auditor can view control actions and artifacts, generate automated artifacts, assess relevance, and manage comments. They cannot view full control definitions, edit controls, connect sources, or upload or delete artifacts. The intended CPA needs an agreed way to receive definitions and retain evidence.
Trust center
Available · Trust Center publishes certifications, reports, FAQs, and security posture, with private document access and NDA workflows.
Security questionnaires
Available · Trust Center accepts uploaded security questionnaires and drafts answers from the Adaptive Evidence Map.
Scope and limits
Trust Center accepts uploaded security questionnaires and drafts answers from the Adaptive Evidence Map. Human review remains necessary before a customer response is sent.
Enterprise administration
Partial · The compliance product documents granular tenant and compliance-only RBAC.
Scope and limits
The compliance product documents granular tenant and compliance-only RBAC. The reviewed public evidence does not establish the directory's complete SSO, SCIM, and RBAC bundle for Compliance.
Continuous control testing
Available · Iru says it continuously collects evidence and checks daily for technology or policy changes that may require control updates.
Scope and limits
Iru says it continuously collects evidence and checks daily for technology or policy changes that may require control updates. Collection intervals can vary by source.
Multi-framework support
Partial · Iru provides named framework libraries and reuses controls and evidence across programs.
Scope and limits
Iru provides named framework libraries and reuses controls and evidence across programs. Public evidence reviewed here does not establish independent native tests for every listed framework.
Funding history
In July 2024, Kandji announced $100M in financing ($50M Series D equity plus $50M in go-to-market financing) at an $850M valuation. Total funding is reported at roughly $288M including that round.
How much does Iru cost?
Iru lists a package price on its site; other configurations require a quote. Third-party estimates suggest a price of up to $15,000 per year for Compliance Automation. Your price depends on plan scope, headcount, services, and contract term.
Price source: view reported prices · checked 2026-09-18
Published prices (1)
| Listed item | Price | Scope |
|---|---|---|
| Iru Core for startups | From $9,000 / year | Iru's startup offer includes Endpoint Management, Endpoint Detection & Response, Vulnerability Management, Compliance Automation with Trust Center, and Workforce Identity for up to 25 endpoint devices, 25 mobile devices, and 25 identity users. Annual commitment, billed annually; additional seats are offered in blocks of ten at an unpublished price. · Source |
Iru's $9,000 annual starting price covers its startup bundle; Compliance Automation on its own and larger fleets require a quote. Iru sells additional seats in blocks of ten but does not list their price. Confirm eligibility, licence counts, renewal terms, and the separate CPA examination fee in writing. Plan source
Ask for the first-year total, renewal cap, implementation charge, required add-ons, and separate audit fee in writing.
How does Iru compare with Comp AI, Vanta, Scytale?
| Attribute | IruThis profile | Comp AI | Vanta | Scytale |
|---|---|---|---|---|
| Best for | Teams seeking SOC 2 automation and device management in one platform | Engineering-led teams that value inspectable code or the option to self-host | Cloud-native SaaS teams on mainstream stacks that value a broad integration catalog | Companies without compliance expertise seeking software plus hands-on advisory |
| Observed price | Up to $15,000 / year for Compliance Automation | Not published | $7,500–$57,207 / year | $7,500 / year |
| G2 rating | 4.7/5 (853 reviews) | 4.7/5 (73 reviews) | 4.6/5 (2,728 reviews) | 4.8/5 (734 reviews) |
| Integrations | Not published | 590+ published | 400+ published | 150+ published |
| Frameworks | 11 listed | 11 listed | 8 listed | 9 listed |
| Onboarding | guided | guided | guided | bundled expert |
| Auditors here | Not published | 4 | 36 | Not published |
| Trust center | Listed | Listed | Listed | Listed |
Which frameworks does Iru support?
- SOC 2Iru says
- ISO 27001Iru says
- ISO 27701Iru says
- ISO 42001Iru says
- GDPRIru says
- HIPAAIru says
- NIST 800-53Iru says
- NIST 800-171Iru says
- NIST CSFIru says
- CMMCIru says
- Cyber EssentialsIru says
Some frameworks use mapped controls rather than native workflows. Confirm the tests and evidence required for each program.
Who does what in a SOC 2 with Iru?
Iru
Organizes the listed control, evidence, and audit workflows.
Your team
Owns policies, control decisions, exceptions, and approval of shared evidence.
The CPA firm
Sets audit scope, tests controls independently, and issues the SOC 2 report.
Software does not issue the SOC 2 report; a licensed CPA firm does. Iru provides restricted Auditor and Compliance Auditor roles, control-linked evidence, lineage, timestamps, policy acknowledgements, and evidence export. Those roles can generate automated artifacts, assess relevance, and comment, but they cannot edit controls or upload or delete artifacts. Iru is the readiness and evidence system, not the licensed CPA firm that performs the examination and signs the SOC 2 report. Buyers should have their intended auditor test a representative evidence package before signing.
Questions to ask in a Iru demo
- Which parts of enterprise administration require another tool or service?
- Can you demonstrate SCIM provisioning in the product?
- Which parts of native multi-framework support require another tool or service?
- Which plan includes SCIM, and is it a paid add-on?
- What is the first-year total, including onboarding, add-ons, and the audit fee?
- What renewal increase and minimum contract term should we put in writing?
- Is the SOC 2 audit contracted with a separate CPA firm, and what does that firm charge?
Iru FAQ
Who runs Iru?
Adam Pettit is the CEO of Iru.
Who founded Iru?
Adam Pettit founded Iru in 2018.
Does Iru include the SOC 2 audit?
Iru provides restricted Auditor and Compliance Auditor roles, control-linked evidence, lineage, timestamps, policy acknowledgements, and evidence export. Those roles can generate automated artifacts, assess relevance, and comment, but they cannot edit controls or upload or delete artifacts. Iru is the readiness and evidence system, not the licensed CPA firm that performs the examination and signs the SOC 2 report. Buyers should have their intended auditor test a representative evidence package before signing. A licensed CPA firm issues the SOC 2 report.
Is Iru itself SOC 2 compliant?
Supporting a buyer's SOC 2 program does not establish that Iru holds a current SOC 2 report. Ask for the vendor's current report during security review.
Similar platforms
Iru on SOC2Auditors
Sources 33 records · last read 2026-10-20
These links show what we checked and when.
| Establishes | Source | Retrieved |
|---|---|---|
| Company announcement names Adam Pettit co-founder and CEO and identifies a Miami East Coast headquarters. | Iru Press | 2026-09-29 |
| Company page lists private status, employee band and a 6,000+ customer claim. | Iru on LinkedIn Marketplace | 2026-09-29 |
| $100M from General Catalyst ($50M equity + $50M debt); total funding over $288M including debt; valuation $850M (Jul 17, 2024). | TechCrunch Press | 2026-09-08 |
| Company wire: $100M from General Catalyst; $50M equity Series D and $50M go-to-market investment; valuation $850M. | GlobeNewswire / Kandji Press | 2026-09-08 |
| Kandji raised $100 million from General Catalyst on July 17, 2024: $50 million Series D equity and $50 million go-to-market investment, at an $850 million valuation. | Iru / Kandji Vendor docs | 2026-09-18 |
| Adaptive Compliance checks source and policy changes daily, proposes control/action wording, and records Admin or Compliance Admin approval or rejection. It does not change evidence attachments, framework configuration or readiness calculations. | Iru product documentation Vendor docs | 2026-09-30 |
| The October 22, 2025 Kandji-to-Iru announcement launches Compliance Automation alongside Workforce Identity and cross-platform Endpoint products. | Iru Vendor docs | 2026-09-30 |
| Independent coverage of Kandji→Iru rebrand and expansion to Windows/Android MDM (Oct 22, 2025). | Computerworld Press | 2026-09-08 |
| Iru describes native endpoint and identity telemetry feeding SOC 2 evidence, while Endpoint Management can enforce encryption and device baselines. | Iru Vendor docs | 2026-09-29 |
| Vanta Device Monitor observes device settings; Vanta recommends an MDM for larger fleets needing policy enforcement and device-configuration management. | Vanta Help Center Vendor docs | 2026-09-29 |
| Drata's read-only Agent checks device settings but does not change device files or folders. | Drata Help Center Vendor docs | 2026-09-29 |
| Drata can ingest device data from multiple separately managed MDM providers for compliance monitoring. | Drata Help Center Vendor docs | 2026-09-29 |
| Dedicated ISO 27001 compliance automation product page. | Iru Vendor docs | 2026-09-08 |
| Iru’s comparison page positions itself as unified endpoint, identity, and compliance versus Drata as a compliance-primary platform. | Iru Vendor docs | 2026-09-08 |
| Current Compliance Automation scope: tailored controls, tasks, Adaptive integrations, artifact relevance, daily Adaptive Compliance suggestions, policies and acknowledgements, auditor validation, Trust Center publishing, and the current framework catalog. | Iru Vendor docs | 2026-09-18 |
| The September 4, 2026 Platform Services Agreement prohibits storing personal health data in the Services under its standard usage restrictions. A separate negotiated written agreement takes precedence. | Iru Vendor docs | 2026-09-29 |
| Iru's HIPAA page, updated October 15, 2026, asks a covered entity or business associate evaluating Iru EDR to review the Platform Services Agreement and contact legal@iru.com about whether a BAA is appropriate. It does not cover Compliance Automation. | Iru product documentation Vendor docs | 2026-10-20 |
| Permission matrix for Compliance Admin, Collaborator, Employee, Auditor, and Compliance Auditor. Auditor and Compliance Auditor can generate automated artifacts, assess relevance, and comment, but cannot edit controls, connect sources, or upload or delete artifacts. | Iru product documentation Vendor docs | 2026-09-18 |
| Trust Center publishing, private document and NDA flows, and AI-assisted security-questionnaire drafting from the evidence map. | Iru Vendor docs | 2026-09-18 |
| Quote-based annual billing with included onboarding and migration support. The pricing page lists a free 14-day trial for Workforce Identity, Endpoint Management, Vulnerability Management, and EDR; Compliance Automation and Trust Center require a personalized demo. | Iru Vendor docs | 2026-09-18 |
| Iru Core startup bundle starts at $9,000 per year on an annual commitment for up to 25 endpoint devices, 25 mobile devices, and 25 identity users. It lists Endpoint Management, EDR, Vulnerability Management, Compliance Automation with Trust Center, and Workforce Identity; additional seats come in blocks of ten with no public added-seat price. | Iru Vendor docs | 2026-09-29 |
| Iru MCP connects compatible AI clients to endpoint API workflows: fleet queries and reports, device assignment and configuration, and lock, wipe, or isolation actions. API key permissions and unattended-action allowlists restrict what clients can attempt. Iru says MCP is included with all its products. | Iru Vendor docs | 2026-09-29 |
| Iru's May 13, 2026 MCP release describes exposure of the Endpoint Management API as MCP tools. It does not establish a Compliance Automation MCP tool set. | Iru Vendor docs | 2026-09-29 |
| Independent September 2026 hands-on evaluation of Endpoint, Identity, and Compliance. Reports fewer Windows management options; Windows behavioral EDR, automatic quarantine, and device isolation planned for early 2027; no native vendor-risk, supplier-assessment, or risk-scoring workflow; a 50-license minimum in the scope reviewed; and Compliance under $15,000 per year. Iru's separate published startup bundle starts with 25 of each listed licence category; confirm the applicable terms in a written quote. | Expert Insights Editorial | 2026-09-18 |
| Iru's Windows page advertises quarantine for files explicitly blocked by hash, path, or publisher. This is a narrower stated scenario than behavioral detection and response; buyers should test the exact Windows controls they require. | Iru Vendor docs | 2026-09-25 |
| Iru's June 15, 2026 update announces Windows EDR as generally available for file-based threat detection and automated response; it does not establish Mac-equivalent behavioral detection or device isolation on Windows. | Iru Vendor docs | 2026-09-29 |
| 4.7 out of 5; 853 reviews captured on the seller page on 2026-09-18 (another G2 surface showed 854). The visible corpus is dominated by endpoint/MDM/EDR experience, with little public review evidence isolating Compliance Automation. | G2 Review platform | 2026-09-18 |
| 4.9 out of 5 across 493 reviews, primarily establishing broader Iru/Kandji endpoint usability, support, and Mac-management experience rather than Compliance Automation maturity. | Capterra Review platform | 2026-09-18 |
| Iru states that its own service holds SOC 2 Type 2 (the security page also uses the heading SOC 2 Type II) and ISO 27001 assurance; buyers can request the current reports under NDA. | Iru Vendor docs | 2026-09-18 |
| Current subprocessor disclosure includes AWS and AI providers OpenAI, Anthropic, xAI, and Arize; public disclosure alone does not establish feature-level retention, training, or residency terms. | Iru Vendor docs | 2026-09-18 |
| Iru's privacy policy gives a Miami legal address while its data processing addendum gives a San Diego address, and the Miami office was announced as an East Coast headquarters alongside California offices, so no single headquarters is established. | Iru Vendor docs | 2026-09-29 |
| Iru documents Endpoint telemetry feeding Vanta for device posture and enrollment evidence; buying Iru Endpoint does not imply replacing Vanta Compliance. | Iru Vendor docs | 2026-09-30 |
| Workforce Identity uses outbound SCIM for supported applications to create, update, and remove accounts, with per-app operation settings and provisioning history. This is separate from SCIM administration of the Compliance Automation product. | Iru product documentation Vendor docs | 2026-09-30 |
Not yet confirmed
- Headquarters · last checked 2026-09-29