Where every figure on this site comes from
Every number here is one of exactly two things, and you can always tell which. Either a vendor published it, in which case we cite the listing, name the dimension, state the band it covers and print the date we checked it. Or it is our own model, in which case we say so beside the number. What this site will not do is present the second kind as the first.
That distinction is doing real work here, because SOC 2 splits cleanly along it. GRC platforms are software and several publish real prices. Audits are attestation engagements and not one firm on earth publishes a fee. A cost site has to be honest about which half it is standing on at any moment.
Platform prices checked July 2026. Site content reviewed July 2026.
Primary sources
Four, and every one of them is free and public. If a source cannot be opened in a browser by anyone reading this page, it is not a source we use.
- GRC platform list prices, AWS Marketplace
Seven platforms (Vanta, Drata, Secureframe, Sprinto, Scytale, Scrut, Strike Graph) publish list-price dimensions on their own AWS Marketplace listings. Every platform price on this site is read directly off the listing and carries the exact dimension name, the employee band the listing scopes it to, and the date we checked it. AWS shows no price-effective date, so the check date is the only honest provenance available and we always print it.
aws.amazon.com / marketplace, per-vendor listings - AICPA Trust Services Criteria (TSC 2017, revised 2022)
The authoritative criteria set every SOC 2 audit reports against. Source for the five Trust Services Criteria taxonomy (Security as the Common Criteria, plus optional Availability, Confidentiality, Processing Integrity and Privacy), and for what is in and out of scope.
aicpa-cima.com / topic / audit-assurance - AICPA SSAE 18 (AT-C 105 + AT-C 205)
Statement on Standards for Attestation Engagements No. 18. AT-C 105 (concepts common to all attestation engagements) and AT-C 205 (examination engagements) are the standards SOC 2 examinations are conducted under. Source for the structure of Type 1 (design at a point in time) versus Type 2 (design and operating effectiveness over a period).
us.aicpa.org / research / standards / ssae - AICPA SOC 2 Description Criteria (DC 200)
Description criteria for a description of a service organization's system. Drives the structure of Section 3 of every SOC 2 report and shapes the scoping work that determines how many criteria and control points end up in the audit, which is the largest driver of fee variance.
aicpa-cima.com / soc-suite-of-services
The cost model, stated openly
Everything the sources above do not cover is our model. A model is a legitimate thing for a cost site to publish, but only if it is labelled as a model and its method is written down where you can argue with it. Here is the method, line by line.
Anchored to published AWS Marketplace dimensions wherever a vendor publishes one. The budget builder's platform floor is set at $9,500, which is the cheapest real published combination in the category: Sprinto's $7,500 platform for up to 100 employees plus its framework line from $2,000. The upper bound spans the published field to Drata's $25,000 platform plus framework lines and add-on modules. Where a vendor publishes nothing (Thoropass, OneTrust GRC), we say so and give no figure.
Our model, and nothing else. No CPA firm publishes a SOC 2 rate card, so there is no external figure our audit numbers could be sourced to and we claim none. The budget builder carries planning assumptions so it can produce a total, labelled in the interface as ours and flagged for replacement with real quotes. We do not publish per-firm fee figures, we do not publish tier bands as though the market had posted them, and we do not compare one named firm's fees against another's, because there are no published rates for such a comparison to be made from.
Our model. Type 1 examines design at a point in time; Type 2 examines operating effectiveness across a period, which means sampling and testing that Type 1 does not require, so Type 2 costs more for the same scope. The two-step path costs more in total than going straight to Type 2 because each report incurs the firm's setup and walkthrough work. The direction of these effects follows from AT-C 205; the size of them in our calculator is our assumption.
Our model. Security, the Common Criteria, is the base scope. Each additional criterion brings additional control points and therefore additional testing hours, so each one raises the fee. That relationship is grounded in the TSC itself. What any given criterion adds in dollars is not published by anyone, so our calculator applies a uniform per-criterion uplift as a planning assumption rather than pretending to know a real rate.
Our model, and the most transparent line we have because it is pure arithmetic: hours times a loaded hourly rate. The calculator uses a blended loaded rate of $85 per hour and scales base hours by company size and by approach, on the reasoning that a platform automates evidence collection that a DIY path does you by hand. Both the rate and the hour counts are our assumptions. If you know your own loaded engineering rate, substitute it, because this is usually the largest line in the programme.
Readiness, security tooling, penetration testing, policy and legal work, and training are our model. They are planning ranges built to be replaced by your own quotes, not published rates, and every table on this site that carries them says so beside the number.
What this site will not publish
A methodology is only worth reading if it rules things out. These are the specific moves that would make our numbers look more authoritative than they are, and we do not make them.
- ×Publish a fee figure for a named CPA firm. No firm publishes a rate card, so any such number would be invented.
- ×Compare one named firm's fees against another's as a percentage. There are no published rates for a percentage to be taken of.
- ×Sum a vendor's published dimensions and present the total as a published price. AWS lists Drata's platform fee and framework fee separately and publishes no combined figure; the total would be our arithmetic wearing a citation.
- ×Report a starting price as a price. Where a listing words a dimension as starting at, we report it as a floor or not at all.
- ×Cite Vendr, G2, Capterra, TrustRadius, PeerSpot or forum threads as a price source. Self-reported aggregator data is not a primary source and we will not launder it into a benchmark.
- ×Rank platforms whose published dimensions are scoped to different employee bands. That produces a ranking out of a scope mismatch.
- ×Rate one platform's product quality above another's. The sources that claim to do this are review aggregators, and we have no independent basis of our own.
How a platform price gets cited
Every published price on this site is written to the same rule, because the ways to get this wrong are specific and repeatable.
- Attributed to the surface, not the company. Vanta publishes a list price of $14,000 on AWS Marketplace for Essentials, 1-20 employees. Never Vanta costs $14,000. A marketplace list price is a public fact; what a company sells at is not something we know.
- The band travels with the number. A price scoped to 100 employees means nothing to a 20-person company, so we never print one without the band its listing states.
- Floors stay floors. Where a listing says starting at, the figure is reported with from in front of it, everywhere it appears.
- Dimensions are never summed. Where a vendor lists a platform fee and a framework fee separately, we print both and let you add the lines your scope needs.
- The check date is always printed. AWS shows no price-effective date, so the date we looked is the only provenance there is.
Refresh cadence
Published platform dimensions are re-read against the listings and the check date moved only when someone has actually looked. A date stamp on this site means the work happened, not that a month passed.
Out-of-cycle triggers:
- A vendor changes a published marketplace dimension.
- A vendor starts or stops publishing a listing.
- The AICPA revises the Trust Services Criteria or AT-C 105 / AT-C 205.
- A correction is filed below and verified against the underlying source.
Out of scope
- -Negotiated audit-fee schedules (not public, and set per engagement)
- -GRC platform contract values for named customers (covered by NDA)
- -Audit-firm partner billing rates (covered by engagement letter)
- -Big 4 SOC 2 fee scales (not published, and outside this site's mid-market focus)
- -Fully-outsourced compliance-as-a-managed-service pricing
- -Industry-specific regulatory layers (HIPAA, PCI DSS, FedRAMP), covered by sister sites in the network
Limitations
A published list price is not a selling price. Several listings also offer a private offer, which is the marketplace mechanism for a price agreed away from list. We can tell you what a vendor published; we cannot tell you what it will charge you.
Audit fees are set per engagement and no firm publishes a rate card, so the audit-firm pages on this site describe what drives a quote rather than predicting the number a firm will produce for you. Get quotes from at least three firms on one written scope.
Calculator outputs are our model, not quotes. They reflect a SaaS-startup to mid-market shape; companies outside that profile should treat the site as directional only.
Internal staff time is the highest-variance component in the whole programme and the one where our assumptions are most likely to miss your reality. Substitute your own loaded rate.
Corrections process
Spotted a published dimension that no longer matches the listing, or a model assumption that does not survive contact with your actual quote? Email [email protected] with the figure and the source. Corrections verified against a primary source are reflected within five business days. We do not publish customer-confidential figures; if your correction rests on an NDA-protected number, point us at the public-source equivalent instead.
See the about page for editorial position, and the platforms comparison for every published dimension with its band attached.