ComplyJet and Polara Labs, compared on what each one publishes

What ComplyJet lists

The same page lists two more plans, and neither prints a figure. Which plan fits depends on how many people you employ and how long ago you incorporated.

• ComplyJet prints no price for its Custom plan, for larger teams, and lists its Takeoff plan, SOC 2 or ISO 27001 with an external audit for very early-stage teams incorporated in the last 12 months with fewer than 5 employees, as Talk to Us. Source (opens in a new tab).

The framework list is long. That matters if a buyer has asked for something other than SOC 2 or ISO 27001, because the request in writing decides which framework you need.

• ComplyJet lists 25+ frameworks, including ISO 27701, ISO 27017, ISO 27018, ISO 9001, CCPA, CMMC 2.0, DORA, NIS 2, the EU AI Act and the NIST AI RMF alongside SOC 2, ISO 27001 and ISO 42001. Source (opens in a new tab).

We sell SOC 2, ISO 27001 and ISO 42001, and readiness programs for HIPAA, GDPR, PCI DSS and NIST CSF 2.0. Every other framework on that list is one we do not sell.

Where the audit comes from

A SOC 2 report is an attestation under the standards of the American Institute of CPAs (AICPA), and only a licensed CPA firm can issue one.¹ So neither company signs your report. Both put an outside firm in the price. Here is how ComplyJet describes its side.

• ComplyJet says every listed plan includes one external audit, conducted for SOC 2 by an independent AICPA-accredited firm from a network of more than 40 audit firms you can choose from, and that your package price is updated to reflect the auditor you choose. Source (opens in a new tab).

Read the last clause twice. The listed figure is a starting point, and the firm you pick moves it. Ours does not move: the auditor engagement fee sits inside our plan price. The examination is performed by an independent partner auditor, a licensed U.S. CPA firm. Polara Labs is not a CPA firm. SOC 2 examinations are performed by independent licensed U.S. CPA firms.

The firm tests your controls against the Trust Services Criteria.² That part does not change with the platform you pick.

What we charge

Our price is on the pricing page, and the first step costs nothing. The free readiness assessment takes about 15 minutes, needs no card, and gives you a readiness score with every gap category counted.

Star is $2,000 one time to get audit-ready. When you want the observation clock to start, Orbit is $7,800 a year, and your SOC 2 Type 2 audit is included in every contract year.

A Type 1 report is an optional add-on to Star, for $2,000 more. The auditor engagement fee sits inside the plan prices.

The audit renews with the plan. There is no second price list for the years after the first.

After you sign

A price is only half of a contract. The other half is what can change once you have signed it. ComplyJet's terms of service answer that in two clauses.

• The ComplyJet terms of service state: "Provider may update pricing by giving at least 15 days notice to Customer including by email or in product notice. Changes apply to the next Subscription Period." Source (opens in a new tab).
• The ComplyJet terms of service set a 1 year subscription period that renews automatically for further 1 year periods unless either party gives notice of non renewal at least 30 days before the current period ends. Source (opens in a new tab).

The first clause applies to the next subscription period, not to a period already running. The second sets the date you need to act by if you want to leave. Our prices never change retroactively.

Side by side

Each cell is something one of the two companies publishes. Where a ComplyJet cell points back up the page, the full statement and its source are there.

Where ComplyJet is the better buy

Four cases, and in each of them we would tell you to spend the money there rather than here. Each one rests on a statement quoted above.

• You will commit for three years. ComplyJet prints a lower yearly figure on its 3 year plan than on its 1 year plan. We publish no rate for a longer term.
• You need a framework we do not sell. ISO 27701, CMMC 2.0, the EU AI Act and the others in the ComplyJet list are not on ours.
• You incorporated in the last 12 months and have fewer than five people. Takeoff is written for exactly that company, and we have no plan written for it.
• You already know which audit firm you want. ComplyJet lets you choose from its network and prices the package to match. We name the firm for you.

If none of those fits, you are buying one report for one customer, and the published price is the thing to weigh. The wider cost picture, with the auditor fee on its own line, is on the SOC 2 cost page. We have written the same comparison for Oneleet, which bundles security services, and for Vanta, which does not audit in house. SOC 2 software that publishes its pricing lists every platform you can price without a call.