Tools · 3 min read

SOC 2 cost calculator

Pick a plan, and every line shows its arithmetic. The numbers are published prices for a company of up to 50 people.

The calculator prices Star and Orbit. Star is $2,000 one time: onboarding, policies and the evidence work, with no examination at that price. Orbit is $7,800 a year, and your SOC 2 Type 2 audit is included in every contract year.

If you start on Star and take Orbit within 12 months, the Star payment comes off your first Orbit year, and it renews at $7,800. You can instead pay that first year monthly on a 12-month term; the Star payment comes off the yearly price only. Constellation, which adds ISO 27001 or ISO 42001, is $10,800 a year. Over 50 people is Mission, priced to your scope.

A range is not a price. The calculator adds up that published list for the plan you pick, shows every line it used, and asks for no email. Change the plan and the total moves.

Which plan?

Star gets your controls, policies and evidence in order. Orbit keeps them that way and puts the audit inside the price. A Type 2 opinion covers how controls operated across a period,¹ which is why the 3-month observation window sits at the front of it.

$7,800Year one

$7,800Year two

$15,600Two years, all in

Orbit, first contract year: $7,800. The platform, continuous evidence collection, and policies written from your own stack.
Your SOC 2 Type 2 audit, first year: Included. Inside the plan. It starts on its own once the 3-month observation window closes, with nothing to buy and nothing to click.
Orbit, second contract year: $7,800. Orbit renews at the same price with your annual audit included.
Your SOC 2 Type 2 audit, second year: Included. Inside the plan again, the same way as the first.

The line this calculator does not need

On Orbit your SOC 2 Type 2 audit is included in every contract year. There is no audit row to estimate and no auditor invoice waiting at the end of the year, so the calculator does not carry one. A made up row would total neatly and be wrong, which is worse than an honest gap.

What this number does and does not cover

Inside the figure are the platform, thirteen policies written from your own stack, and an evidence binder mapped to the trust services criteria.² On Orbit your SOC 2 Type 2 audit is included in every contract year, and no second invoice arrives from the CPA firm. If a buyer wants a point in time report before then, a Type 1 report adds $2,000 to Star. Where the auditor fee sits is broken out here.

A penetration test is not in there. Some buyers require one, some never ask. Nor are the infrastructure changes you make to close a gap. Neither has a number we could publish and stand behind. Inventing one is the exact habit this page was built to avoid.

For comparison

Vanta and Drata both publish what they think a SOC 2 should cost you. Neither prints what it charges on its own website. Both halves are below, each one a click from its source. None of these figures is a two year total, so read them against year one above rather than the two year line. The last two are the 12-month software prices each company prints on its own AWS Marketplace listing, and Vanta pricing and Drata pricing add those up with the audit fee.

Vanta states that a SOC 2 audit fee usually runs between $10,000 and $50,000, and that the all-in cost of a first SOC 2 lands somewhere between $10,000 and $80,000 or more. Source.
Vanta lists four plans on its pricing page and no dollar figure. The call to action is to request personalized pricing. Source.
Drata estimates the audit fee for a SOC 2 Type 1 at $7,500 to $15,000 and for a Type 2 at $12,000 to $20,000 for small to midsize companies, and puts the total first-year cost at $25,000 for a small startup. Source.
Drata lists its compliance plans, Foundation, Advanced and Enterprise, on a plans page with no dollar figure, and each plan button leads to a demo request. Source.
Vanta’s own AWS Marketplace listing prices its Essentials package at a starting cost of $14,000 for a 12-month contract, for 1 to 20 employees. Source.
Drata’s own AWS Marketplace listing prices the Drata Platform Fee, with capacity for a 100 FTE organization, at $25,000 for a 12-month contract, and the SOC 2 framework at $7,500 on a separate line. Source.

The full breakdown, including why the auditor fee and the platform fee get bundled together so often, is on how much SOC 2 costs, and SOC 2 software that publishes its pricing lists the platforms you can run through a calculator like this one. If you are still deciding which report you need, Type 1 versus Type 2 covers the sequencing. The other half of the estimate is how much work is left, and the free readiness assessment counts it: know your cost here, then go and check your readiness there.

One thing no platform can do

Sign its own report. No second invoice arrives from the independent partner auditor, and the opinion is that firm’s to give or withhold. Polara Labs is not a CPA firm. SOC 2 examinations are performed by independent licensed U.S. CPA firms.³

Questions

Is this an estimate or the actual price?

It is the published price for the plan you pick, for a company of up to 50 people.

Does the total include the auditor fee?

Yes. On Orbit your SOC 2 Type 2 audit is included in every contract year, and a Type 1 report added to Star includes the Type 1 examination. No second invoice arrives from the CPA firm.

What happens once I have had a second SOC 2 audit?

Nothing changes. On Orbit your SOC 2 Type 2 audit is included in every contract year, so the second year's audit comes with the second year of the plan, and the calculator counts it as included.

Why does year two look different from year one?

On Orbit it does not: the plan renews at the same price with the audit inside it. On Star year two is zero, because Star is a one time payment and nothing renews.

What is not included in this number?

A penetration test if your buyer requires one, and any infrastructure changes you need to make to close a gap. Those vary too much to put a number on honestly.

Sources

SOC 2 Report AICPA. What a SOC 2 report is and who may issue one.
TSP Section 100, Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy AICPA. The criteria themselves, including the common criteria every SOC 2 report covers.
State Boards of Accountancy directory NASBA. Where to confirm a CPA firm holds an active license in its state.

Get audit-ready without a compliance team.

The readiness assessment is free, with no payment and no card. Star is $2,000 one time to get on the platform and close your gaps. Orbit is $7,800 a year, and your SOC 2 Type 2 audit is included in every contract year. You can be audit-ready starting at about a week.

Take the free assessment

Polara Labs is not a CPA firm. SOC 2 examinations are performed by independent licensed U.S. CPA firms.