SOC 2 auditor plus platform bundle: what to check before you buy

This page covers what a bundle includes, the three ways vendors handle the examination fee, what has to stay with the firm, and what our own published price includes. If you want the fee itself broken down first, what a SOC 2 auditor charges covers the hours behind it.

What a bundle covers, and what stays with the CPA firm

Read the table by its middle column. Anything a vendor can do, a bundle can include. The last three rows belong to the firm, whatever the invoice says.

Three ways vendors handle the examination fee

Bundles exist to answer one question early: what will the examination cost? Bought separately, that number arrives in a second contract, after you have signed the first. On the vendor pages we have read, the fee is handled in one of three ways.

Included in the platform price. One figure covers the software and an examination by an outside firm.

• ComplyJet lists its Core plan, one framework for up to 50 employees, from $9,999 a year on a 1 year plan or from $7,999 a year on a 3 year plan, with one external audit by an independent firm included. Source.

Sold by the same company, on its own line. The vendor performs the audit itself and prices it apart from the platform.

• Thoropass states on its homepage that it is a licensed auditor that delivers audits, supported by its own software, and that its audit team performs an independent assessment. Source.
• Thoropass’s own AWS Marketplace listing prices its compliance platform, first framework included, from $8,700 for a 12-month contract, and a SOC 2 audit subscription from $5,800. Source.

Left to a firm you choose. The platform sells software and prints no examination fee of its own.

• LowerPlane lists its Starter plan at $4,995 a year, billed annually, for one framework, and states that auditor fees are separate and paid directly to your chosen auditor. Source.
• Strike Graph lists its Scale plan as starting at $21,500 a year and its Enterprise plan at $35,000, shows no figure for its Certify plan, and states that audit pricing is set directly by the auditor you select. Source.
• Vanta’s pricing page lists access to Vanta’s auditor network and the ability to bring your own auditor among its plan features, and names no auditor fee. Source.

The third model has a real advantage. You pick the firm, you see its fee, and you can change firms without changing software. Changing SOC 2 auditors covers what moves with you. The first two give you a total before you commit. SOC 2 software that publishes its pricing lists every platform we found with a printed figure, and whether that figure includes an examination.

What has to stay with the firm, whoever sends the invoice

The AICPA’s ethics staff have set out the arrangements between CPA firms and SOC 2 tool providers that can threaten a firm’s independence, or its ability to follow the standards.³ A bundle is exactly that kind of arrangement. Four of them are worth a direct question.

Referrals and exclusivity

A firm that gets a concentration of its clients from one tool provider, or works with it exclusively, can face pressure to subordinate its judgment.

A seat in the examination

A provider with a contractual right to observe the audit work, or to sit in on discussions between the firm and you.

Fixed deadlines

A completion date set by the provider without regard to the firm’s judgment about scope, risk, staffing and the evidence it needs.

Gag terms and paid evidence

Contract terms that stop the firm communicating required matters to you, or that make the firm pay the provider to see the evidence for your examination.

Where a threat is significant and no safeguard reduces it, the guidance says performing or continuing the examination is not appropriate. None of this shows on an invoice. The firm knows. Ask it.

How to check a bundle before you sign

1. Ask which examination is inside the price. Type 1, Type 2 or both, and for which years. A price that covers the first report says little about the second.
2. Get the firm’s name in writing. Do it before the engagement letter, then find the firm in its state board’s license register⁴ or through CPAverify.⁵
3. Ask about peer review. The AICPA Peer Review Program covers firms that perform attest work, so ask the firm for its most recent result.⁶
4. Ask the firm, not the vendor, about the arrangement. Does anything in its agreement with the platform limit what it can test or report?
5. Read who signs. The opinion is the firm’s, on its letterhead. Management signs the assertion. Who can perform a SOC 2 audit covers the rest.
6. Ask what happens to your evidence if you leave. Work you cannot export is work you pay for twice. Leaving a compliance platform lists what to take with you.

When a low bundle price is a warning

A price well below what firms quote on their own is a fair reason to look harder. One CPA firm says so in public:

• Linford and Company warns buyers to be careful when a compliance tool has a partner audit firm with a set fee far below other bids, citing a case where one firm issued the same form report to every client with only the names changed. Source.

A low price is not proof of a bad audit. A high one is not proof of a good one. Read the tests instead: in a Type 2 report they should name your own systems, your own people and your period. A report that reads the same for every client is the case that warning describes. Whether a cheap SOC 2 audit is legitimate works through the objection, and how to tell if a SOC 2 report is real shows the checks on a finished report.

What our published price includes

Polara Labs publishes its SOC 2 prices, and the examination sits inside them. It is performed by an independent partner auditor, a licensed U.S. CPA firm.

• Star, $2,000 one time. The platform, your gap analysis, policies written from your own stack and the evidence binder. No examination at this price.
• A Type 1 report, $2,000 more. Added to Star, it is the Type 1 examination and the report. No second invoice arrives from the CPA firm.
• Orbit, $7,800 a year. The platform for up to 50 people, and your SOC 2 Type 2 audit is included in every contract year. Take Orbit within 12 months of paying for Star and the Star payment comes off the yearly price of your first Orbit year, not off the monthly schedule.
• Constellation, $10,800 a year. Everything in Orbit plus ISO 27001 and ISO 42001 readiness.

Over 50 people, or a scope beyond these plans, is Mission, priced to your scope.

The firm assigned to your engagement is named in the engagement letter, before you sign it. Our software refuses a completed opinion from anyone except the practitioner the firm assigned, and our independence page lists what else it enforces. If you would rather choose and pay a firm yourself, the third model above is built for that.