Thoropass Scorecard

Thoropass sells the audit and the software as one purchase. It scores 52 out of 100 on our rubric, last of the six vendors in our SOC 2 compliance software ranking, behind Scrut at 72.

Its audit path is the strongest in the set. Thoropass Assurance, its own licensed CPA firm, delivers the signed report inside the platform, and the audit path scores a full 5 out of 5. Trust and questionnaires also score well, at 4 out of 5, with a trust center on a custom domain and AI-assisted due diligence questionnaires. The rest of the scorecard pulls the total down hard: vendor risk, customisation and pricing transparency all score 0, and automated evidence scores 1, since Thoropass gives no integration count.

What you get

Thoropass sells six service lines: the audit itself, a compliance suite, penetration testing, vulnerability scanning, Thoropass AI and integrations and APIs. The compliance suite is where most of the daily work happens: it connects your cloud, identity and other tools, collects evidence against the controls in your framework, and also houses the risk register and the due diligence questionnaire tool.

Founded in 2019 as Laika, the company renamed itself Thoropass in March 2023. It is based in New York and raised a $50 million Series C in November 2022. Thoropass says it runs more than 500 audits a year through its own in-house auditors.

Plans and pricing

Thoropass has no plan name, no price and no feature table, which is one reason pricing transparency is a 0 out of 5 on our rubric.

On AWS Marketplace, Thoropass sells a Compliance Platform subscription from $8,700 a year, which includes your first framework, plus a separate SOC 2 Audit subscription from $5,800 a year performed by its in-house auditors. Neither figure earns credit on our rubric, since pricing transparency counts only a vendor’s list prices and plan details.

Our compliance software pricing study lines up every vendor’s lowest list price. Secureframe is the only one of the seven scored vendors that lists a price, $7,500 a year for its Fundamentals plan. Drata’s lowest AWS Marketplace listing is $15,000 a year for 1 to 50 employees.

Thoropass $8,700 No band listed

Sprinto $9,500 Up to 100 employees

Vanta $14,000 1 to 20 employees

Secureframe $15,000 Up to 100 employees

Scrut $15,000 Up to 20 employees

Drata $15,000 1 to 50 FTE

Pricing study

Frameworks

Thoropass names SOC 1, SOC 2, ISO 27001, NIST CSF 2.0, Cyber Essentials, GDPR, PCI DSS, CMMC Level 1, HIPAA and HITRUST on its frameworks page, with more under its multi-framework offering. In September 2026, a subsidiary, Thoropass Certification LLC, was accredited to run its own ISO/IEC 27001:2022 certification audits, so Thoropass can now issue SOC reports and ISO 27001 certificates from the same company.

Framework coverage earns 5 out of 5 on our rubric: the five core frameworks plus three of the rubric’s extras, NIST CSF 2.0, CMMC Level 1 and ISO 42001. Thoropass says it supports ISO 42001 in its OrO Way offering for multi-framework compliance. Its CMMC product covers Level 1, which places it among the platforms in our CMMC compliance software ranking.

Evidence collection and monitoring

Thoropass gives no integration count. Two AI tools sit on top of the evidence layer: Smart Sort AI, which Thoropass says turns an evidence export from any other GRC platform into audit-ready documentation, and First Pass AI, which screens evidence before it reaches an auditor. Thoropass says that combining AI-powered automation with expert auditors reduces audit overhead by up to 80 percent and speeds up audits by 62 percent.

Integrations are described as auditor-vetted and feed continuous compliance monitoring. Automated evidence scores 1 out of 5 on our rubric, with no integration count to credit.

Audits

Audits are delivered inside the platform by Thoropass’s own licensed CPA firm. Thoropass Assurance, renamed from Laika Compliance in December 2025, is registered with the AICPA and achieved the AICPA’s highest Peer Review rating that same month. A second entity, Thoropass Certification LLC, was accredited in September 2026 to run ISO/IEC 27001:2022 certification audits, giving Thoropass two in-house audit arms instead of a referral to an outside firm.

Thoropass says an auditor works inside your account from scoping through the final report, reviewing evidence as it comes in rather than waiting for a document dump at the end. Its penetration testing service is CREST-accredited, so a pentest can sit on the same contract as the audit.

Audit path scores 5 out of 5 on our rubric, the only criterion where Thoropass leads the field outright. Secureframe, Vanta and Drata all route you to a partner firm instead of auditing you themselves.

Vendor risk

Thoropass has no standalone vendor risk product, only its Risk Register and due diligence tools. Risk Register tracks internal risk against your own controls on a 4x4 or 5x5 matrix, which is not the same job as rating a supplier.

Vendor risk earns no credit on our rubric. Sprinto, Vanta and Scrut score 5 out of 5 here, Drata scores 4 and Secureframe 2. If vendor reviews take up real time on your security team, start with one of those five instead.

Trust center and security questionnaires

Thoropass’s trust center launched in 2025 and runs on a custom domain such as trust.yourcompany.com, free on every plan, including audit-only subscriptions. Visitors can download public documents on their own or request private ones, and a document can be gated behind an NDA that a visitor signs by typing their name inside the portal.

A separate due diligence questionnaire tool answers inbound security questionnaires with AI. Trust and questionnaires scores 4 out of 5 on our rubric: both tools exist and questionnaire answering is AI-assisted, one step short of the top band, which also credits AI that draws on a customer’s own live evidence and policies rather than a static knowledge base.

Policies and people

Thoropass automates policy creation, review and sign-off.

Security training and device compliance run through integration partners rather than a native Thoropass feature.

Support and services

Thoropass says it pairs the software with compliance experts who work inside your process. One G2 reviewer said it can take Thoropass half a year to fix small issues.

What G2 reviewers say

Thoropass holds 4.7 out of 5 from 585 reviews on its main G2 profile. 82% of reviews are five stars and 16% are four stars. G2 also tracks two smaller, separate listings, Thoropass Audit (20 reviews) and Thoropass Pentesting (19 reviews). The figures here are from the main platform profile.

4.7 585 reviews

5 82 %

4 16 %

3 0 %

2 0 %

1 0 %

Praised for

Ease of use 239

Helpfulness 221

Customer support 171

Compliance guidance 157

Team helpfulness 115

Complaints

Lack of clarity 39

Integration issues 34

Interface needs work 33

Audit issues 32

General improvements needed 31

All reviews on G2 ↗

Ease of use and helpfulness lead the praise, followed by customer support, compliance guidance and team helpfulness. Complaints are smaller and more scattered: lack of clarity, integration issues, interface work, audit issues and general improvements.

A small-business reviewer on the team: “Their team! Always friendly and professional!”

Who should buy Thoropass

• Companies that want one vendor for the software and the signed report. Audit path scores 5 out of 5 because Thoropass Assurance delivers the audit inside the platform.
• Teams that need a trust center from day one. It ships free on every plan, including audit-only subscriptions, with NDA-gated documents and AI-assisted questionnaire answering.
• Buyers chasing both SOC 2 and ISO 27001 from one company. Thoropass Certification LLC’s September 2026 accreditation means both reports can come from Thoropass itself.

Who should look elsewhere

• Vendor risk is part of your program. Vendor risk scores 0 here. Sprinto, Vanta and Scrut score 5 out of 5, and Drata scores 4.
• You want a price before the first call. Pricing transparency also scores 0. Secureframe is the only one of the seven that lists a price, $7,500 a year for its Fundamentals plan.
• You will build custom frameworks or custom tests. Customisation scores 0. Sprinto scores 5 out of 5, and Vanta, Drata and Secureframe score 4.
• You need the widest integration catalog. Automated evidence scores 1 out of 5 here, with no integration count to credit. Vanta claims 400 or more and scores 5 out of 5.

How we score it

Thoropass scores 52 out of 100 on rubric v0.9. It earns full marks on three criteria: framework coverage, audit path, since Thoropass Assurance delivers the signed report inside the platform, and user sentiment, from a 4.7 average across 585 G2 reviews. Four criteria cost it the most: vendor risk, customisation and pricing transparency all score 0, and automated evidence scores 1, with no integration count to credit.

Framework coverage 5/5 Tied 1st of 7

Automated evidence 1/5 7th of 7

Audit path 5/5 1st of 7

Pricing transparency 0/5 Tied 6th of 7

Trust and questionnaires 4/5 Tied 1st of 7

Vendor risk management 0/5 7th of 7

Customisation 0/5 7th of 7

User sentiment 5/5 Tied 1st of 7