Thoropass pricing and what Thoropass costs a year with the SOC 2 audit included

The short answer: Thoropass lists its Compliance Platform, with your first framework included, at $8,700 for 12 months on AWS Marketplace, and a SOC 2 Audit subscription at $5,800. Bought together that is $14,500 a year for the software and the audit, which no other SOC 2 platform publishes as one figure. What buyers sign is larger: recorded purchases on Vendr have a median of $25,964 a year, in a range of $1,145 to $52,387.

Every figure below was read on October 13, 2026 from a primary record: Thoropass's own pricing page, its AWS Marketplace listing, the master subscription agreement attached to that listing, and Vendr's recorded contracts. The competitor list prices come from their own AWS rate cards, read in September 2026.

How much does Thoropass cost?

Thoropass does not print a price on thoropass.com. Its pricing page is a sales page with a form. The numbers are on AWS Marketplace, because a vendor selling there has to attach a price to every contract dimension. The Thoropass listing has exactly two.

Read the range with care. A $1,145 contract is almost certainly not a full platform deal but a single small item, most likely a scan or a one-off service, and the low end of any contract range describes scope rather than negotiating skill. The median is the useful number. At $25,964 it sits about $11,500 above the two list prices combined, which is what a second framework, a Type II observation window, a penetration test or a larger headcount adds.

Why the audit in the price changes the comparison

Every SOC 2 platform review compares software prices. That is the wrong unit for a buyer whose goal is a SOC 2 report, because the platform does not produce the report. A licensed CPA firm does. Vanta, Drata, Secureframe and Sprinto sell readiness software and then introduce you to audit partners, who bill separately. Vendr's own Thoropass page puts a separate assessment at roughly $10,000 to $30,000 or more depending on framework and scope.

Thoropass is different because its auditors are in-house. The AWS listing describes the two subscriptions as working together: the platform for readiness, the audit subscription for the attestation itself. That makes $14,500 the only published all-in SOC 2 price among the five platforms compared here. It also means the same company prepares you and then tests you, which some customers of your own may ask about. Thoropass publishes a statement on audit independence for exactly that reason, so read it and keep a copy for the security questionnaires you answer.

On the software alone, Thoropass at $8,700 is cheaper than Vanta and Drata and a little dearer than Sprinto with one framework. Add an auditor to the other four and the order changes, sometimes by a lot. The full rate cards and what the contracts look like are on our Vanta pricing and Drata pricing pages, and the Sprinto rate card breakdown explains why its extra frameworks are the cheapest in the group.

The renewal clause that is not a cap

The master subscription agreement attached to the AWS listing (last modified May 2023) is where the year-two price is decided. Section 6.3 says renewal fees are "subject to up to a seven percent (7%) increase above the applicable pricing in the prior Subscription Term, unless Thoropass provides notice of different pricing at least thirty (30) days prior". Read the second half again. The 7 percent limit applies only when Thoropass does not send a new price. If it does, with a month's notice, there is no limit at all.

Two windows matter and they are different lengths. Thoropass has to tell you about a new price at least 30 days out, and you have to tell Thoropass you are leaving at least 15 days out. So a price notice that arrives on day 30 leaves you about two weeks to get competing quotes, which is not enough to run a fair comparison. Start the renewal 90 days ahead and ask for the year-two price in writing before Thoropass sends one.

The headcount clause is the other one worth reading slowly. Platform prices in this category scale with company size, and the agreement lets Thoropass measure yours before renewal and charge the difference. A startup that doubles its staff in a year should expect the renewal to reflect it. The fix is a written headcount band with a known price for the next band.

What a first SOC 2 with Thoropass really costs

For a US software company of under 50 people buying its first SOC 2, a sensible budget has four lines. The platform and audit at list are $14,500. A Type II report needs an observation window, typically several months, so ask whether the audit price covers Type I, Type II or both. Penetration testing is sold separately by Thoropass, and many enterprise customers ask to see a recent one. And internal time is real: someone has to write policies, connect cloud accounts and answer evidence requests.

Some evidence is cheap to produce if the tooling already exists. The SOC 2 availability criteria ask how you detect outages, and an uptime monitor with alert history gives the auditor a dated record rather than a screenshot taken the week of fieldwork. Logging, access reviews and vendor reviews work the same way: the older the trail, the smoother the Type II.

If the budget question is SOC 2 against the rest of your obligations, our SOC 2 compliance software guide compares the platforms on features and the Vanta competitors page prices the whole shortlist.

How to get a fair Thoropass quote

1. Ask for both subscriptions as separate lines. Platform and audit, so you can compare the platform with Vanta or Drata and the audit with an independent CPA firm.
2. Name the frameworks for three years. The listing includes one framework. A second one, ISO 27001 or HIPAA, is where the median comes from.
3. Fix the renewal. A fixed year-two price, or the 7 percent limit without the notice exception, and the headcount band written down.
4. Compare against the published list. If a quote for one framework and a SOC 2 audit comes in well above $14,500 at a small headcount, ask what is carrying it.

Where ComplianceOfficer fits

Thoropass gets you a SOC 2 report. It does not tell you when the rules around your customers' data change, and for a US software company those move constantly: state privacy laws taking effect, the FTC's Safeguards Rule notification duty for non-bank financial firms, new AI disclosure laws in California, Colorado and Texas. ComplianceOfficer keeps a register of those obligations, checks the primary sources every day, explains each change in plain language and drafts the policy update for the gap you mark. It costs $149 a month, and the scan at the top of this page shows the register for a B2B SaaS company.

Questions buyers ask

How much does Thoropass cost?

Thoropass lists two 12-month subscriptions on AWS Marketplace: the Compliance Platform, including your first framework, starting at $8,700, and a SOC 2 Audit subscription starting at $5,800. Together that is $14,500 a year for software plus the audit. Recorded Thoropass purchases on Vendr, read October 13, 2026, have a median of $25,964 a year and a range of $1,145 to $52,387.

Does Thoropass pricing include the SOC 2 audit?

Only if you buy the second subscription. The AWS listing sells the platform and the audit as two separate contracts that bill independently. The platform covers readiness and your first framework. The Audit Subscription covers a SOC 2 audit performed by Thoropass's in-house auditors, from $5,800. Vanta, Drata, Secureframe and Sprinto price the platform without the audit.

Does Thoropass publish its prices?

Not on its own site. The thoropass.com pricing page shows no dollar figure and routes to a sales form. The figures are on its AWS Marketplace listing, where every contract dimension has to carry a price, and in the master subscription agreement attached to that listing.

How much can Thoropass raise the price at renewal?

Up to 7 percent over the prior term, unless Thoropass gives notice of different pricing at least 30 days before the renewal, in which case the 7 percent limit does not apply. Promotional or one-time prices renew at list price. Subscriptions renew for a year automatically unless you give written notice at least 15 days before the term ends.

Is Thoropass cheaper than Vanta or Drata?

On list price for the software alone, Thoropass at $8,700 sits below Vanta Essentials at $14,000 and Drata Foundation at $15,000, and above Sprinto at $9,500 with one framework. Once the SOC 2 audit is added, Thoropass is $14,500 all in, while the others still need a separate auditor. Compare like for like by asking every vendor for platform plus audit.