What SOC 2 actually costs

So the useful version of the question is narrower than the search term. Not what does SOC 2 cost, but which of the two costs am I being quoted, and what is the other one. If you want the sequencing question first, Type 1 versus Type 2 covers which report your buyer is actually asking for.

What the invoice is made of

A SOC 2 has two costs, always, no matter who you buy it from. Conflating them is what makes the published ranges so wide and so useless.

The platform fee

Software that collects evidence, tracks controls, writes policies and assembles the package. This is the part vendors sell.

The auditor fee

What a licensed CPA firm charges to examine your controls and sign an opinion under the AICPA attestation standards.¹ Software cannot do this. No platform, including this one, is permitted to sign its own report.²

Of the two, the auditor fee is the one nobody itemizes. What a SOC 2 auditor actually charges breaks down what that number is made of, hour by hour.

What the published figures actually say

The two above are not the only ones. These are the rest of what a search returns today, quoted rather than summarized, each read from its own page.

• Drata estimates the audit fee for a SOC 2 Type 1 at $7,500 to $15,000 and for a Type 2 at $12,000 to $20,000 for small to midsize companies, and puts the total first-year cost at $25,000 for a small startup. Source.
• LowerPlane publishes three annual plans, Starter at $4,995, Growth at $9,995 and Scale at $15,995 a year, and states that auditor fees are separate and paid directly to your chosen auditor, with no auditor figure given. Source.

What each published figure covers

Most of the disagreement above disappears once you ask what each number pays for. Read across first. Then compare.

How much SOC 2 costs for a 10-person startup

No vendor we checked publishes a figure for exactly ten people. The closest published total, software and audit together, is a scenario for a company two and a half times that size:

• Drata gives a scenario for a startup of 25 employees with a total cost of about $28,000, covering a boutique audit, a compliance platform and a penetration test. Source.

Software-only prices come closer on headcount:

• Vanta’s own AWS Marketplace listing prices its Essentials package at a starting cost of $14,000 for a 12-month contract, for 1 to 20 employees. Source.
• None of the ten lines on the Vanta listing is an audit or an auditor fee, and its overview states that pricing is tiered by company size and program complexity. Source.

Vanta pricing adds the software and the audit together.

Headcount moves the work more than the price. Ten people means fewer accounts to review, fewer laptops to manage and fewer vendors to assess, but the criteria are the same ones a large company answers. SOC 2 for a small team covers the five controls that change at that size. Our own price does not move with headcount up to fifty people, which is why the prices further down apply to a company of two or of fifty.

Most of this category gates its own price

This is not a rhetorical flourish. Every one of these was opened and read on its own page.

• Vanta lists four plans on its pricing page and no dollar figure. The call to action is to request personalized pricing. Source.
• Secureframe lists its Fundamentals plan as starting at $7,500 a year and shows no dollar figure for its other two plans, Complete and Defense. Every plan links to a quote request. Source.
• Drata lists its compliance plans, Foundation, Advanced and Enterprise, on a plans page with no dollar figure, and each plan button leads to a demo request. Source.
• Suralink publishes no price, stating that every company and team has different needs and inviting prospects to reach out. Source.

That is the practical problem with every range above. They tell you what an audit costs in general, and not one of them tells you what the company publishing the range would charge you. Those are different questions. Vanta and Drata print their own software prices only on their AWS Marketplace listings, which Vanta pricing and Drata pricing work through, audit fee added. The vendor by vendor version is in the Vanta alternative and Drata alternative comparisons, and SOC 2 software that publishes its pricing lists every platform that prints a number.

What we charge

Polara Labs publishes its SOC 2 prices. Orbit is $7,800 a year, and your SOC 2 Type 2 audit is included in every contract year, performed by an independent partner auditor, a licensed U.S. CPA firm. The platform fee and the auditor engagement fee arrive as one number, which is the part that makes it comparable to nothing else above.

The auditor fee sits inside the plan price rather than arriving as a second invoice later. That is the part most quotes leave out.

The table is the price list for a company of up to 50 people on one or two frameworks. Over 50 people, or three or more frameworks, is Mission, priced to your scope.

What a year actually looks like

Year one is one plan. Star is a one time payment that gets your books in order, and Orbit is the yearly plan with the audit inside it. Scope drives the rest, and a team under twenty people has less of it to cover: what Type 1 actually requires walks through the decisions that move the number.

On Orbit alone the year is $7,800. Take Orbit within 12 months of paying for Star and the Star payment comes off the first Orbit year, so Star and that first Orbit year together come to $7,800 as well. No second invoice arrives from the CPA firm, so neither figure is waiting on an auditor invoice that has not arrived yet. Compare that against the section above, where the platforms that print no price on their own websites still leave the examination as a separate contract on top of whatever their quote turns out to be. The SOC 2 cost calculator shows the arithmetic line by line.

The obvious objection

Auditor fees, where anyone publishes them at all, run higher than Star with a Type 1 report added, which is onboarding and the Type 1 examination together. Drata’s own Type 1 audit fee range starts above that whole total. So ours must be missing something. That is a fair thing to think, and the people who publish the higher numbers say it out loud:

• One published practitioner breakdown puts a Security-only Type 2 at 60 to 80 auditor hours, at partner rates of $250 to $350 per hour and staff rates of $100 to $175, giving a stated floor near $9,000. Source.
• Linford and Company warns buyers to be careful when a compliance tool has a partner audit firm with a set fee far below other bids, citing a case where one firm issued the same form report to every client with only the names changed. Source.

When the package arrives complete, indexed and mapped to criteria, the independent partner auditor’s hours go into testing rather than chasing: asking for a screenshot, receiving the wrong one, asking again. Whether a cheap audit is legitimate takes that objection apart properly, including how to check a firm with its state board.

Verify it rather than taking our word for it. The firm on your engagement is disclosed on request before you sign the engagement letter, and every U.S. CPA firm is searchable in its state board’s public license register.³ Our head to head comparison sets out where we are genuinely a worse fit than the incumbents, which is the other half of an honest price argument.

How to compare quotes honestly

1. Ask whether the auditor fee is inside the quote. If it is billed later, the quote is not comparable to anything. Here is what that number is made of.
2. Ask whether the first examination is included or billed on top once you are already committed.
3. Ask about year two. Renewal is where compliance pricing moves, and the second year is the one that decides what this really costs.
4. Ask what happens to your evidence if you leave. Work that cannot be exported is work you will pay for twice.

One number is missing from every quote above, including ours: how much work is left at your company. The free readiness assessment scores that and counts the gaps before any of this is payable.