Thoropass pricing: the platform line, the audit line, the quote

Why the audit is on Thoropass’s own bill

Vanta, Drata, Secureframe and Sprinto sell software and connect you to a separate CPA firm. Thoropass is both. It says so on its homepage:

• Thoropass states on its homepage that it is a licensed auditor that delivers audits, supported by its own software, and that its audit team performs an independent assessment. Source.
• Thoropass’s homepage FAQ says that because its platform combines software and audit delivery, its pricing typically reflects both, and that this bundled approach can often cost less than separate vendors for readiness tooling and audit services. Source.

That changes what a Thoropass quote is. A Vanta or Drata quote covers software, and you still need an audit quote from a firm. A Thoropass quote can cover both. Compare it with the two quotes added together, not with the software quote alone.

Only a licensed CPA firm may issue a SOC 2 report,¹ and Thoropass states that it is one. So the audit line on its listing is a firm’s fee, sold on the same contract as the software. Who can sign a SOC 2 report explains the rules that apply to any firm.

What the AWS listing adds up to

AWS Marketplace lets a vendor sell a 12-month contract billed through the buyer’s AWS account, and Thoropass is the seller on this one. Its two lines together come to $14,500 for a year at the starting prices.

Read the word “starting” twice. The platform figure includes one framework. The audit line names SOC 2 but not whether it is a Type 1 or a Type 2, and a Type 2 takes months of testing. Your quote will move with scope and headcount, as the FAQ says, and with the length of any observation window.

Against a platform with a separate auditor

Set the bundle beside the largest platform that sells software only. Vanta prints its starting price on AWS and estimates the audit fee separately:

• Vanta’s own AWS Marketplace listing prices its Essentials package at a starting cost of $14,000 for a 12-month contract, for 1 to 20 employees. Source.
• Vanta states that a SOC 2 audit fee usually runs between $10,000 and $50,000, and that the all-in cost of a first SOC 2 lands somewhere between $10,000 and $80,000 or more. Source.

On starting prices, the bundle above costs a little more than that software line alone. It costs less than the software line plus even the low end of Vanta’s own audit estimate. That is the case Thoropass makes in its FAQ, and the published figures support it. The comparison stops at the starting prices, because both vendors quote everything past them.

Set Drata beside it too. It sells software only, priced for a larger team, and estimates the audit separately:

• Drata’s own AWS Marketplace listing prices the Drata Platform Fee, with capacity for a 100 FTE organization, at $25,000 for a 12-month contract, and the SOC 2 framework at $7,500 on a separate line. Source.
• Drata estimates the audit fee for a SOC 2 Type 1 at $7,500 to $15,000 and for a Type 2 at $12,000 to $20,000 for small to midsize companies, and puts the total first-year cost at $25,000 for a small startup. Source.

So the Drata software alone starts well above the whole Thoropass bundle. It also covers up to 100 people, where the Thoropass listing states no headcount. Ask both for the same headcount and the same report type.

What buyers report paying

One purchasing service publishes what its own customers paid for Thoropass:

• Vendr, a software buying service, reports that the median buyer pays $28,464 per year for Thoropass. Source.

That is Vendr’s data, not a Thoropass price. It sits well above the two starting prices, and it covers whatever frameworks, audits and services those buyers bought. Use it to check a quote, not to predict one.

Where Thoropass is the better buy

Several of its strengths are things a software-only platform cannot sell. The published record supports these cases:

• You want one company for the platform and the audit. One contract and one relationship instead of two.
• You already run another compliance tool.
  • The same FAQ says Thoropass can work alongside a third-party governance, risk and compliance platform, so a team can keep the compliance tool it already uses. Source.
• You need frameworks beyond SOC 2.
  • The Thoropass homepage lists SOC 2, ISO 27001, GDPR, PCI DSS, HITRUST and HIPAA, and its site navigation also lists SOC 1, CMMC Level 1, NIST CSF 2.0 and Cyber Essentials. Source.
• You want the penetration test from the same company.
  • Thoropass offers penetration testing and vulnerability scanning, and describes its pentest experts as CREST-accredited. Source.

Ask Thoropass, like any firm, for its latest peer review, the AICPA program that checks the quality of a firm’s attest work.² The Thoropass comparison covers the alternatives.

How to get a quote you can compare

Ask for these in writing, from Thoropass and from anyone you weigh it against:

• The platform and the audit as separate lines, with what each covers.
• Whether the audit is a Type 1 or a Type 2, and the observation window.
• The second year’s price, and whether it can rise at renewal.
• Penetration testing, priced or excluded.

The SOC 2 software pricing index sets the Thoropass listing beside every other published price we could find, and the auditor fee guide explains what moves the audit line.

What Polara Labs publishes

We sell the platform, and the audit is performed by an independent partner auditor, a licensed U.S. CPA firm, a separate company from us. Star is $2,000 one time to get audit-ready. Orbit is $7,800 a year, and your SOC 2 Type 2 audit is included in every contract year. The price is on our site, so no call stands between you and the number. We do not perform penetration tests.