Menu
Thoropass
Thoropass combines SOC 2 readiness and evidence software, advisory services, and an affiliated CPA audit practice. Its separate licensed firm, Thoropass Assurance, performs the attestations under independence rules the company describes.
Best for: Teams wanting software and a connected audit process from the same providerWatch for: Common ownership may conflict with buyer policy; outside-CPA access and exit rights need written confirmation Read our Thoropass review →
AI and MCP
MCP server: Official. Access: Limited write: evidence requests only (submit, attach files, comment, and delete its own comments and attachments); audits, controls and policies are read-only. Checked 12 Oct 2026.
Who does what in a SOC 2 with Thoropass?
Thoropass
Organizes the listed control, evidence, and audit workflows.
Your team
Owns policies, control decisions, exceptions, and approval of shared evidence.
The CPA firm
Sets audit scope, tests controls independently, and issues the SOC 2 report.
Software does not issue the SOC 2 report; a licensed CPA firm does. The SOC 2 report is issued by Thoropass Assurance, the trade name of Laika Compliance, LLC, a licensed CPA firm registered with the AICPA; Thoropass, Inc. (the software company) is a separate legal entity under the same corporate umbrella, per the company's own /company/legal page. The two-entity structure is vendor-described, not by itself a conclusion about independence in a buyer's engagement. The AICPA's public peer review file records Laika Compliance, LLC with a report rating of Pass, accepted 12 December 2025, covering the period to 31 January 2025; a buyer still needs the proposed firm's independence assessment and engagement letter. Thoropass's own /independence-and-excellence page describes the people and process separation (Customer Success on one side, auditors on the other) that sits behind it. Two purchase paths exist and most comparisons in this category describe only the first. Bundled, the platform and the audit come from the same provider relationship and run in one connected workflow; AWS Marketplace lists the platform and audit as separate subscription dimensions that bill independently, so buyers should confirm the Order Forms and renewal terms rather than assume a single contract. Audit-first, you keep the GRC platform you already run and engage Thoropass Assurance as the independent auditor: Thoropass states its Audit Lifecycle Platform works with any GRC platform and system of record, and its Smart Sort AI feature, announced 29 January 2026, turns an export from any GRC tool into audit-ready evidence with no integration to build. Both are Thoropass's own claims. The constraint runs the other way: Thoropass's materials describe the audit being performed by Thoropass Assurance and do not document bringing an outside CPA firm into the workspace, so a buyer who wants to keep the software and rotate audit firms should ask about that directly. Competing vendors state that limit outright; Thoropass's own pages do not.
What does Thoropass do?
Thoropass was founded in 2019. Thoropass is led by Sam Li. Thoropass says it serves more than 2,000 organizations.
Evidence collection
Available · "Integrations and monitors vetted by auditors, that automatically satisfies evidence requests while powering transparent continuous compliance monitors."
Auditor workspace
Available · The audit runs inside the same platform end to end ("from evidence to report, your entire audit is finally connected"); this is Thoropass's core differentiator versus software-only platforms.
Trust center
Available · Current product navigation documents Trust Center under Trust.
Scope and limits
Current product navigation documents Trust Center under Trust. This establishes the module, not a universal plan entitlement.
Security questionnaires
Available · Thoropass lists Questionnaires under Trust.
Scope and limits
Thoropass lists Questionnaires under Trust. Confirm automation, reviewer permissions and usage limits in your proposed plan.
Enterprise administration
Available · Thoropass documents SSO, SCIM provisioning, and roles/permissions.
Scope and limits
Thoropass documents SSO, SCIM provisioning, and roles/permissions. Multi-entity support is not confirmed either way; SCIM IdP limitations are recorded in the separate capability row.
SCIM provisioning
Available · Thoropass documents SCIM 2.0 provisioning through Entra and Okta, with SSO as a prerequisite.
Scope and limits
Thoropass documents SCIM 2.0 provisioning through Entra and Okta, with SSO as a prerequisite. Google Workspace is unsupported. For Okta, the current article warns that SCIM-installed apps work but catalog-installed apps do not while Thoropass and Okta resolve the issue. No public tier is named.
Continuous control testing
Available · Vendor markets "proactive monitoring capabilities" that flag issues ahead of audit windows, framed as continuous rather than point-in-time.
Multi-framework support
Available · Each framework (SOC 1, SOC 2, ISO 27001, HITRUST, etc.) has its own dedicated framework page and audit type; the vendor separately advertises "up to 90% crossover between frameworks" as a control-reuse efficiency feature layered on top of, not instead of, natively built controls.
Funding history
Thoropass (as Laika) has raised $98M total across four rounds, most recently a $50M Series C led by Fin Capital with Centana Growth and existing investors J.P. Morgan Growth Equity Partners, Canapi, and ThirdPrime, which closed and was announced November 8, 2022 per PR Newswire and TechCrunch.
How much does Thoropass cost?
Thoropass's direct plans require quotes; a separate channel lists scoped prices. AWS Marketplace offers start at $14,500 a year. Your price depends on plan scope, headcount, services, and contract term. Read the Thoropass pricing guide.
Price source: view reported prices · checked 2026-10-20
Published prices (2)
| Listed item | Price | Scope |
|---|---|---|
| Compliance Platform | From $8,700 / year | AWS Marketplace 12-month platform dimension ("Platform Subscription, including your first framework"); billed separately from the SOC 2 Audit Subscription. · Source |
| SOC 2 Audit Subscription | From $5,800 / year | AWS Marketplace 12-month audit dimension; billed separately from the platform. · Source |
The platform and audit dimensions bill separately; these Marketplace floors do not establish a matched total or renewal terms. Plan source
Ask for the first-year total, renewal cap, implementation charge, required add-ons, and separate audit fee in writing.
How does Thoropass compare with Vanta, Drata, Comp AI?
| Attribute | ThoropassThis profile | Comp AI | Iru | Vanta | Drata |
|---|---|---|---|---|---|
| Best for | Teams wanting software and a connected audit process from the same provider | Engineering-led teams that value inspectable code or the option to self-host | Teams seeking SOC 2 automation and device management in one platform | Cloud-native SaaS teams on mainstream stacks that value a broad integration catalog | Growth-stage SaaS teams on mainstream stacks that expect to add frameworks over time |
| Observed price | $14,500 / year | Not published | Up to $15,000 / year for Compliance Automation | $7,500–$57,207 / year | $9,415–$68,250 / year |
| G2 rating | 4.7/5 (582 reviews) | 4.7/5 (73 reviews) | 4.7/5 (853 reviews) | 4.6/5 (2,728 reviews) | 4.7/5 (1,397 reviews) |
| Integrations | 200+ published | 590+ published | Not published | 400+ published | 300+ published |
| Frameworks | 11 listed | 11 listed | 11 listed | 8 listed | 10 listed |
| Onboarding | bundled expert | guided | guided | guided | guided |
| Auditors here | 1 | 4 | Not published | 36 | 45 |
| Trust center | Listed | Listed | Listed | Listed | Listed |
Will Thoropass connect to your stack?
Thoropass reports 200+ integrations. Check the exact fields, tests, permissions, and plan coverage for each tool you need.
Check 9 named tools
| Tool | Coverage | Scope |
|---|---|---|
| AWS | Listed integration | Thoropass documents AWS-driven monitors and evidence collection. Source |
| Google Cloud | Listed integration | Thoropass documents GCP-driven monitors. Source |
| Microsoft Azure | Listed integration | Thoropass documents Azure-driven monitors. Source |
| Okta | Listed integration | Thoropass names Okta among integrations that generate control monitors. Source |
| Google Workspace | Listed integration | Thoropass documents Google Workspace directory and Drive document sync. Source |
| GitHub | Listed integration | Thoropass documents GitHub integration for audit population requests. Source |
| Jira | Listed integration | Thoropass help documents Jira PM and evidence-request sync. Source |
| Slack | Listed integration | Thoropass help documents a Slack integration. Source |
| Rippling | Listed integration | Thoropass documents a Rippling connector for employee populations. Source |
Which frameworks does Thoropass support?
- SOC 2Thoropass says
- SOC 1Thoropass says
- ISO 27001Thoropass says
- ISO 42001Thoropass says
- HIPAAThoropass says
- HITRUSTThoropass says
- PCI DSSThoropass says
- GDPRThoropass says
- NIST CSFThoropass says
- CMMCThoropass says
- Cyber EssentialsThoropass says
Which auditors work with Thoropass?
1 licensed audit firms in our directory list Thoropass experience. Listing experience is not an endorsement.
| Firm | Licence | Peer review |
|---|---|---|
| ThoropassPublished Type 2 fee: $12,000–$85,000 | Licensed CPA | Pass |
Questions to ask in a Thoropass demo
- What is the first-year total, including onboarding, add-ons, and the audit fee?
- What renewal increase and minimum contract term should we put in writing?
- Is the SOC 2 audit contracted with a separate CPA firm, and what does that firm charge?
Thoropass FAQ
Where is Thoropass based?
Thoropass is headquartered in New York, New York, United States.
Who runs Thoropass?
Sam Li is the CEO of Thoropass.
Who founded Thoropass?
Sam Li and Eva Pittas and Austin Ogilvie founded Thoropass in 2019.
Does Thoropass include the SOC 2 audit?
The SOC 2 report is issued by Thoropass Assurance, the trade name of Laika Compliance, LLC, a licensed CPA firm registered with the AICPA; Thoropass, Inc. (the software company) is a separate legal entity under the same corporate umbrella, per the company's own /company/legal page. The two-entity structure is vendor-described, not by itself a conclusion about independence in a buyer's engagement. The AICPA's public peer review file records Laika Compliance, LLC with a report rating of Pass, accepted 12 December 2025, covering the period to 31 January 2025; a buyer still needs the proposed firm's independence assessment and engagement letter. Thoropass's own /independence-and-excellence page describes the people and process separation (Customer Success on one side, auditors on the other) that sits behind it. Two purchase paths exist and most comparisons in this category describe only the first. Bundled, the platform and the audit come from the same provider relationship and run in one connected workflow; AWS Marketplace lists the platform and audit as separate subscription dimensions that bill independently, so buyers should confirm the Order Forms and renewal terms rather than assume a single contract. Audit-first, you keep the GRC platform you already run and engage Thoropass Assurance as the independent auditor: Thoropass states its Audit Lifecycle Platform works with any GRC platform and system of record, and its Smart Sort AI feature, announced 29 January 2026, turns an export from any GRC tool into audit-ready evidence with no integration to build. Both are Thoropass's own claims. The constraint runs the other way: Thoropass's materials describe the audit being performed by Thoropass Assurance and do not document bringing an outside CPA firm into the workspace, so a buyer who wants to keep the software and rotate audit firms should ask about that directly. Competing vendors state that limit outright; Thoropass's own pages do not. A licensed CPA firm issues the SOC 2 report.
Is Thoropass itself SOC 2 compliant?
Supporting a buyer's SOC 2 program does not establish that Thoropass holds a current SOC 2 report. Ask for the vendor's current report during security review.
What does Thoropass integrate with?
Thoropass reports 200+ integrations. Confirm the fields, tests, permissions, and plan coverage for your own tools.
Similar platforms
Thoropass on SOC2Auditors
More guides and comparisons (1)
Sources 33 records · last read 2026-10-20
These links show what we checked and when.
| Establishes | Source | Retrieved |
|---|---|---|
| Company page gives 2019 founding and names Sam Li, Eva Pittas and Austin Ogilvie as co-founders. | Thoropass Vendor docs | 2026-09-29 |
| Company page lists New York headquarters, private status and employee band. | Thoropass on LinkedIn Marketplace | 2026-09-29 |
| April 2026 company announcement claims more than 1,200 customers. | Thoropass Press | 2026-09-29 |
| Company article confirms the $50M Series C led by Fin Capital. | Thoropass Press | 2026-09-29 |
| Founded 2019 as Laika; rebranded to Thoropass in March 2023. Corroborated by Thoropass's March 29, 2023 PR Newswire rebrand release and CEO origin post. | CB Insights Third-party estimate | 2026-09-11 |
| Confirms the Laika-to-Thoropass rebrand announcement dated March 29, 2023. | PR Newswire Press | 2026-07-24 |
| Confirms $50M Series C led by Fin Capital, closed November 8, 2022, bringing total funding to $98M. | PR Newswire Press | 2026-07-24 |
| Independent press confirmation of the $50M Series C and its date. | TechCrunch Press | 2026-07-24 |
| States that Laika Compliance, LLC dba Thoropass Assurance is the licensed AICPA-registered CPA firm, and Thoropass, Inc. dba Thoropass is the separate technology/professional-services entity. | Thoropass (vendor) Vendor docs | 2026-07-24 |
| Describes the audit arm as "our affiliated audit entity," explains the AICPA independence framework applied, and cites a 2025 AICPA peer review with the highest ("pass") rating. | Thoropass (vendor) Vendor docs | 2026-07-24 |
| Public File Search, firm name "Laika", returns Laika Compliance LLC (firm number 900255351244, Annandale VA): period covered 02/01/2024 to 01/31/2025, peer review acceptance date 12/12/2025, report rating Pass. Read from the AICPA's own public file rather than from the vendor's summary of it, which is why the peer review is graded independently confirmed rather than vendor-claimed. | AICPA Peer Review Program Standards body | 2026-07-27 |
| Published starting prices: $8,700/year platform subscription and $5,800/year SOC 2 audit subscription. AWS presents them as separate subscription dimensions that bill independently and work together. FAQ text retrieved 2026-09-11 says both are required to move from readiness through final attestation in one workflow on that listing. Fees are non-cancellable and non-refundable except as required by law. A free-trial row is shown with no duration stated. | AWS Marketplace Marketplace | 2026-10-20 |
| Vendr displays a $25,000 median annual contract and an observed $1,145–$50,880 range. The $1,145 low is not a planning floor. The page treats Thoropass as software-only and states a separate third-party CPA fee, which does not match the affiliated-exam path. | Vendr Third-party estimate | 2026-09-10 |
| Vendor markets connected SOC 1 readiness, evidence collection, and audit with expert auditors. Does not establish one contract covering software and examination, or that every independence policy accepts the affiliated-auditor model. | Thoropass (vendor) Vendor docs | 2026-08-31 |
| Vendor markets ISO 42001 readiness, evidence collection, and audit through its platform. This establishes product support, not the terms or issuing firm for a buyer's assessment. | Thoropass (vendor) Vendor docs | 2026-09-29 |
| Vendor markets a connected evidence-to-report audit workflow with expert auditors inside the platform. Speed and overhead percentages on the page are vendor claims and are not used as facts on the FinTech shortlist. | Thoropass (vendor) Vendor docs | 2026-08-31 |
| Announcement dated 29 January 2026 stating the Audit Lifecycle Platform "works seamlessly with any GRC platform and systems of record" and that Smart Sort AI lets customers "upload exported files from any vendor's GRC system with no integration required" and turn them into audit-ready evidence. Establishes the audit-first purchase path, where the customer keeps its existing GRC platform, as a vendor-stated capability. File upload rather than live sync, and untested by us. | Thoropass (vendor newsroom) Vendor docs | 2026-07-27 |
| Source of the audit-cycle figure: First Pass "helped to reduce audit timelines from 73 days, already an industry benchmark, to just 29 days, a 60% reduction." Vendor-measured, still published as of this retrieval. | Thoropass (vendor) Vendor docs | 2026-07-27 |
| Public G2 product page displayed 4.7/5 from 582 reviews. Thoropass homepage marketing retrieved the same day displayed 4.8/5. | G2 Review platform | 2026-09-11 |
| Current SSO/SCIM setup for Entra and Okta, including Google Workspace exclusion and the temporary Okta catalog-app limitation. | Thoropass (vendor help center) Vendor docs | 2026-08-11 |
| HIPAA framework support recorded as vendor-claimed. | Thoropass Vendor docs | 2026-07-24 |
| Vendor-claimed HIPAA framework program. Confirm the risk-analysis deliverables and implementation support in the quoted scope. | Thoropass Vendor docs | 2026-08-31 |
| Thoropass describes one connected evidence-to-report workflow with embedded audit expertise, while its public entity notice identifies Laika Compliance, LLC dba Thoropass Assurance as the AICPA-registered CPA firm and Thoropass, Inc. as the technology/professional-services firm. Use the existing independently checked peer-review record for any claim stronger than this vendor-described workflow. | Thoropass Vendor docs | 2026-08-31 |
| The MSA describes telephone, email, or online-chat assistance during the subscription term as set out in the applicable Order Form. Do not promise a particular support level without the buyer's Order Form. | Thoropass Vendor docs | 2026-08-31 |
| Thoropass says its pricing varies by framework, audit scope, company size, and required services, and buyers receive a tailored quote. | Thoropass Vendor docs | 2026-08-31 |
| The 12-month Marketplace dimensions list the Compliance Platform starting at $8,700 and the SOC 2 Audit Subscription starting at $5,800; the page says they bill independently and final cost varies by scope. | AWS Marketplace Marketplace | 2026-10-20 |
| Not established. The reviewed DPA covers customer personal data but does not establish a HIPAA BAA route or permission to upload PHI. | SOC2Auditors.org Editorial | 2026-08-31 |
| Thoropass documents AWS-driven monitors and evidence collection. | Thoropass Vendor docs | 2026-09-29 |
| Thoropass documents Google Workspace directory and Drive document sync. | Thoropass Vendor docs | 2026-09-29 |
| Thoropass documents GitHub integration for audit population requests. | Thoropass Vendor docs | 2026-09-29 |
| Thoropass help documents Jira PM and evidence-request sync. | Thoropass Vendor docs | 2026-09-29 |
| Thoropass gives a New York mailing address in its privacy policy, and its job listings describe it as headquartered in New York. | Thoropass Vendor docs | 2026-09-29 |
| Audit-workflow scope, permissions, exports or explicitly unestablished entitlement; see the field-specific auditWorkflow notes. | Thoropass Vendor docs | 2026-09-30 |