Menu
Scytale
Scytale is a compliance automation platform that pairs software with optional hands-on consulting. Plans range from a platform-led starter package to six- and twelve-month programs with a dedicated consultant, penetration testing, and an auditor workspace.
Best for: Companies without compliance expertise seeking software plus hands-on advisoryWatch for: Build Starter is platform-only; packages that bundle the platform with compliance expert support are available separately. Read our Scytale review →
AI and MCP
MCP server: Official. Access: Read-only. Checked 14 Oct 2026.
Who does what in a SOC 2 with Scytale?
Scytale
Organizes the listed control, evidence, and audit workflows.
Your team
Owns policies, control decisions, exceptions, and approval of shared evidence.
The CPA firm
Sets audit scope, tests controls independently, and issues the SOC 2 report.
Scytale is a software vendor, not a CPA firm. Some packages include a dedicated in-house compliance expert, and its AWS Marketplace listing sells third-party audit and penetration-testing services as separate line items. The SOC 2 report itself is issued by an external, independent CPA firm arranged through or alongside Scytale, not by Scytale itself.
What does Scytale do?
Scytale was founded in 2021. Scytale is led by Meiran Galis. Scytale says it serves 1,000+ companies worldwide.
Evidence collection
Available · "Automated evidence collection" and "24/7 continuous monitoring of controls" are base-tier line items on the vendor's own pricing/feature table.
Auditor workspace
Available · The Audit Management Hub centralizes document requests, evidence approvals, audit status and auditor action items.
Scope and limits
The Audit Management Hub centralizes document requests, evidence approvals, audit status and auditor action items. A full permission matrix, export format and auditor-seat inclusion remain unestablished; consulting support is package-specific.
Trust center
Available · Trust Center is listed in current platform packaging.
Scope and limits
Trust Center is listed in current platform packaging. Blank extracted grid icons do not establish every feature gate; confirm the selected package.
Security questionnaires
Available · Questionnaire automation is listed in current platform packaging.
Scope and limits
Questionnaire automation is listed in current platform packaging. Consulting packages separately state expert-review allowances; those allowances do not establish a universal automation limit.
Enterprise administration
Available · Scytale lists SSO and role-based access controls across Build, Scale, and Enterprise.
Scope and limits
Scytale lists SSO and role-based access controls across Build, Scale, and Enterprise. Okta's catalogue confirms SCIM create/update/deactivate provisioning. Multi Workspaces is an add-on on Scale and included up to three workspaces on Enterprise; SCIM tier inclusion is not public.
SCIM provisioning
Available · Okta's current catalogue lists Scytale with SCIM create, update, and deactivate provisioning.
Scope and limits
Okta's current catalogue lists Scytale with SCIM create, update, and deactivate provisioning. Scytale's own pricing page does not name SCIM, so capability is evidenced while tier inclusion remains unknown.
Continuous control testing
Available · "24/7 continuous monitoring of controls" and "On-demand compliance checks" are listed as base-tier features.
Multi-framework support
Available · SOC 2, ISO 27001, ISO 42001, HIPAA, PCI DSS, GDPR, SOX ITGC, and C5 each have their own dedicated framework page and can each be purchased as a distinct "Additional Platform Framework" line item on AWS Marketplace, consistent with separately built control sets rather than a single SOC-2-only crosswalk.
Scope and limits
SOC 2, ISO 27001, ISO 42001, HIPAA, PCI DSS, GDPR, SOX ITGC, and C5 each have their own dedicated framework page and can each be purchased as a distinct "Additional Platform Framework" line item on AWS Marketplace, consistent with separately built control sets rather than a single SOC-2-only crosswalk. Anything outside that named list is handled through a "Custom Frameworks" consulting add-on whose control depth is not published.
Funding history
Scytale has disclosed no specific funding total or round name; a June 2025 Calcalist (Ctech) report describes it only as having "raised tens of millions of dollars from private investors," and separately, in June 2025, Scytale acquired Israeli SOX-compliance startup AudITech for roughly $15M.
How much does Scytale cost?
Scytale's direct plans require quotes; a separate channel lists scoped prices. AWS Marketplace offers start at $7,500 a year. Your price depends on plan scope, headcount, services, and contract term. Read the Scytale pricing guide.
Price source: view reported prices · checked 2026-10-20
Published prices (7)
| Listed item | Price | Scope |
|---|---|---|
| AWS Marketplace Software Platform | From $7,500 / 12-month contract | Security Compliance Automation Hub: software access and one framework, starting price per organization size, quote required. · Source |
| AWS Marketplace Additional Platform Framework | From $2,100 / 12-month contract | One additional framework (for example SOC 2, ISO 27001 or PCI DSS) with automation and support, starting price, quote required. · Source |
| AWS Marketplace Framework Consulting | From $4,000 / 12-month contract | Dedicated compliance expert support, starting price, quote required. · Source |
| AWS Marketplace Offensive Security (PT) | From $4,500 / 12-month contract | Advanced security penetration testing, starting price, quote required. · Source |
| AWS Marketplace Virtual Compliance | From $36,000 / 12-month contract | Personal vGRC/vDPO expert full support, starting price, quote required. · Source |
| AWS Marketplace Security Questionnaires | From $12,000 / 12-month contract | Security questionnaires with AI and expert review, starting price, quote required. · Source |
| AWS Marketplace 3rd Party Audit | $4,200 / 12-month contract | Third-party audit services offered through the listing; the listing names no audit firm or report type. · Source |
Scytale's AWS Marketplace listing prices one software dimension and six service packages separately for 12 months; every line except the audit service says it is a starting price that depends on organization size and a quote. The lines do not add up to a complete order, and the listing is not a direct-plan price list. Plan source
Ask for the first-year total, renewal cap, implementation charge, required add-ons, and separate audit fee in writing.
How does Scytale compare with Strike Graph, Comp AI, Drata?
| Attribute | ScytaleThis profile | Comp AI | Iru | Strike Graph | Drata |
|---|---|---|---|---|---|
| Best for | Companies without compliance expertise seeking software plus hands-on advisory | Engineering-led teams that value inspectable code or the option to self-host | Teams seeking SOC 2 automation and device management in one platform | Teams reusing evidence across frameworks with visible higher-plan starting prices | Growth-stage SaaS teams on mainstream stacks that expect to add frameworks over time |
| Observed price | $7,500 / year | Not published | Up to $15,000 / year for Compliance Automation | Free tier | $9,415–$68,250 / year |
| G2 rating | 4.8/5 (734 reviews) | 4.7/5 (73 reviews) | 4.7/5 (853 reviews) | 4.6/5 (196 reviews) | 4.7/5 (1,397 reviews) |
| Integrations | 150+ published | 590+ published | Not published | 300+ published | 300+ published |
| Frameworks | 9 listed | 11 listed | 11 listed | 8 listed | 10 listed |
| Onboarding | bundled expert | guided | guided | unknown | guided |
| Auditors here | Not published | 4 | Not published | 1 | 45 |
| Trust center | Listed | Listed | Listed | Listed | Listed |
Will Scytale connect to your stack?
Scytale reports 150+ integrations. Check the exact fields, tests, permissions, and plan coverage for each tool you need.
Check 8 named tools
| Tool | Coverage | Scope |
|---|---|---|
| AWS | Listed integration | Scytale documents a read-only role connection per AWS service, such as IAM, S3, EC2, CloudTrail and GuardDuty; the services, regions and tests covered vary by plan. Source |
| Google Cloud | Listed integration | Scytale documents a service-account connection for a named set of Google Cloud services; the GCP IAM connection also requires the Google Workspace integration. Source |
| Microsoft Azure | Listed integration | Scytale documents a read-only app-registration connection for a listed set of Azure services; other Microsoft services use separate connections. Source |
| Okta | Listed integration | Scytale documents an API-token connection that collects Okta users and access privileges; collecting the admin list requires a token from a Super Administrator. Source |
| Google Workspace | Listed integration | Scytale documents a Google sign-in connection with read-only directory and reporting scopes; a Super Administrator must authorize it. Source |
| GitHub | Listed integration | Scytale documents a GitHub App connection per organization with read-only scopes; GitHub Actions, Issues and Dependabot are connected separately. Source |
| Jira | Listed integration | Scytale documents an API-token connection that collects only resolved Jira tickets; the change-approval monitor needs optional admin scopes. Source |
| Slack | Listed integration | Scytale documents a Slack connection that posts compliance notifications to a channel; it does not describe collecting evidence from Slack. Source |
Which frameworks does Scytale support?
- SOC 2Scytale says
- ISO 27001Scytale says
- ISO 42001Scytale says
- EU AI ActScytale says
- HIPAAScytale says
- PCI DSSScytale says
- GDPRScytale says
- SOX ITGCScytale says
- C5Scytale says
Questions to ask in a Scytale demo
- What is the first-year total, including onboarding, add-ons, and the audit fee?
- What renewal increase and minimum contract term should we put in writing?
- Is the SOC 2 audit contracted with a separate CPA firm, and what does that firm charge?
Scytale FAQ
Where is Scytale based?
Scytale is headquartered in New York, New York, United States.
Who runs Scytale?
Meiran Galis is the CEO of Scytale.
Who founded Scytale?
Meiran Galis founded Scytale in 2021.
Does Scytale include the SOC 2 audit?
Scytale is a software vendor, not a CPA firm. Some packages include a dedicated in-house compliance expert, and its AWS Marketplace listing sells third-party audit and penetration-testing services as separate line items. The SOC 2 report itself is issued by an external, independent CPA firm arranged through or alongside Scytale, not by Scytale itself. A licensed CPA firm issues the SOC 2 report.
Is Scytale itself SOC 2 compliant?
Supporting a buyer's SOC 2 program does not establish that Scytale holds a current SOC 2 report. Ask for the vendor's current report during security review.
What does Scytale integrate with?
Scytale reports 150+ integrations. Confirm the fields, tests, permissions, and plan coverage for your own tools.
Similar platforms
Scytale on SOC2Auditors
Sources 28 records · last read 2026-10-20
These links show what we checked and when.
| Establishes | Source | Retrieved |
|---|---|---|
| Company page gives its 2021 founding and identifies CEO and founder Meiran Galis. | Scytale Vendor docs | 2026-09-29 |
| Company page lists New York headquarters, private status, customer claim and employee band. | Scytale on LinkedIn Marketplace | 2026-09-29 |
| Current OIN listing shows SCIM create, update, and deactivate provisioning for Scytale. | Okta Marketplace | 2026-08-11 |
| Founded 2021 by Meiran Galis; independent Israeli tech press confirmation of founding year and founder, plus the June 2025 AudITech acquisition (~$15M). | Calcalist (Ctech) Press | 2026-07-24 |
| The 12-month listing prices the software platform with one framework from $7,500; an additional framework from $2,100; framework consulting from $4,000; penetration testing from $4,500; virtual compliance from $36,000; security questionnaires from $12,000; and third-party audit services at $4,200. Every line except the audit service says starting price, quote required. The $7,500 floor is a starting price, not a disclosed fixed package price. | AWS Marketplace Marketplace | 2026-10-20 |
| No dollar amounts. Build Starter is platform-led; Build DFY combines the platform with LaunchReady consulting (dedicated consultant for up to six months) and a black-box web-app penetration test; Build Stronger combines it with StayReady consulting (dedicated consultant for 12 months) and a gray-box web-app penetration test. Both list one framework with add-ons available. ComplianceShield provides a dedicated GRC team. The feature matrix also confirms SSO, role-based access controls, auditor hub, automated evidence collection, and 24/7 continuous monitoring; no mention of SCIM appears on the page. | Scytale (vendor) Vendor docs | 2026-08-11 |
| Build Starter lists the platform and one framework without a consulting plan. Build DFY includes LaunchReady consulting, a dedicated consultant for a maximum of six months, weekly project calls until audit completion, one-time policy alignment, and a black-box web-app penetration test. Build Stronger includes StayReady consulting, a dedicated consultant for 12 months, ongoing policy updates, regular calls based on audit proximity, and a gray-box web-app penetration test. Both bundles include one framework with add-ons available. No named bundle prices are published. | Scytale (vendor) Vendor docs | 2026-08-31 |
| Vendor markets PCI DSS automation, continuous monitoring, and compliance experts. Does not establish SAQ or ROC issuance, package inclusion of PCI, or an all-in price. | Scytale (vendor) Vendor docs | 2026-08-31 |
| An older page claims connections to 100+ tools. Scytale's marketing team confirmed by email on 2026-08-11 that 150+ is the current figure to use and that older pages and assets may lag as integrations are added. | Scytale (vendor) Vendor docs | 2026-08-11 |
| Claims 150+ integrations. Scytale's marketing team confirmed by email on 2026-08-11 that this is the current figure to use. | Scytale (vendor) Vendor docs | 2026-08-11 |
| Claims 150+ native integrations for the SOC 2 product, consistent with the current figure Scytale's marketing team confirmed on 2026-08-11. | Scytale (vendor) Vendor docs | 2026-08-11 |
| Claims support for 80+ security, privacy, and AI frameworks. Scytale's marketing team confirmed by email on 2026-08-11 that the total includes smaller frameworks and divisional or add-on frameworks related to the main frameworks in the public library. The page's "+200 more" integration preview is an older asset; Scytale asked us to use 150+ integrations. The registry's nine frameworkClaims are itemized evidence, not total coverage. | Scytale (vendor) Vendor docs | 2026-08-11 |
| 4.8/5 rating across 734 reviews. Star split 648 / 83 / 2 / 0 / 1. Recurring cons tags included Integration Issues (43) and Limited Integrations (32). G2 listed 99 integrations on the product page; that is not the vendor-confirmed 150+ catalog total. | G2 Review platform | 2026-09-11 |
| Homepage marketing displayed 700+ reviews / 4.8, 80+ frameworks, 150+ integrations, Trusted by 1000+ companies, and 'only AI GRC platform with human experts.' The 700+ figure is marketing; G2 showed 734 the same day. | Scytale (vendor) Vendor docs | 2026-09-11 |
| Re-read 2026-09-11: still no dollar amounts. Build Starter, Build DFY (Done for you), and Build Stronger remain the public startup packages. This was not a full-record re-verification. | Scytale (vendor) Vendor docs | 2026-09-11 |
| Confirms the AI GRC agent is named "Scy" and describes its role inside the platform. | Scytale (vendor) Vendor docs | 2026-07-24 |
| HIPAA framework support recorded as vendor-claimed. | Scytale Vendor docs | 2026-07-24 |
| Vendor-claimed HIPAA workflow: ongoing monitoring of PHI safeguards with compliance-expert guidance. | Scytale Vendor docs | 2026-08-31 |
| Not established. The reviewed Scytale framework page describes HIPAA program support but does not establish the vendor's own PHI permission or customer BAA route. | SOC2Auditors.org Editorial | 2026-08-31 |
| Help-center setup guide documents the AWS connection. | Scytale Vendor docs | 2026-09-29 |
| Help-center setup guide documents the Google Cloud connection. | Scytale Vendor docs | 2026-09-29 |
| Help-center setup guide documents the Microsoft Azure connection. | Scytale Vendor docs | 2026-09-29 |
| Help-center setup guide documents the Okta connection. | Scytale Vendor docs | 2026-09-29 |
| Help-center setup guide documents the Google Workspace connection. | Scytale Vendor docs | 2026-09-29 |
| Help-center setup guide documents the GitHub connection. | Scytale Vendor docs | 2026-09-29 |
| Help-center setup guide documents the Jira connection. | Scytale Vendor docs | 2026-09-29 |
| Help-center setup guide documents the Slack connection. | Scytale Vendor docs | 2026-09-29 |
| Audit-workflow scope, permissions, exports or explicitly unestablished entitlement; see the field-specific auditWorkflow notes. | Scytale Vendor docs | 2026-09-30 |