There is no Thoropass list price, and the reason matters
Seven GRC platforms publish list-price dimensions on AWS Marketplace. Thoropass is not among them, and it would be easy to file that under vendor opacity. It is not. The other seven sell software, and software can carry a list price. Thoropass sells a subscription with a SOC 2 examination inside it, and a SOC 2 examination is an attestation engagement performed under AICPA standards, scoped and priced per client and fixed in an engagement letter. No CPA firm on earth publishes a rate card for one.
So a Thoropass price is not a number that exists somewhere and is being withheld. It is a number that comes into being when someone scopes your engagement. Any figure you find attributed to Thoropass on the open web is somebody's reported invoice or somebody's guess, and this page carries neither.
What actually sets the quote
A Thoropass quote has a software component and an audit component, and the audit component moves for the same reasons any CPA engagement moves. The drivers are worth knowing because they are the ones you control before you ask for a number.
- System boundary. Which products, environments and supporting systems sit inside the description. The single biggest driver.
- Trust Services Criteria in scope. Security, the Common Criteria, is the base. Availability, Confidentiality, Processing Integrity and Privacy each add control points and testing. See the criteria breakdown.
- Type 1 or Type 2. Design at a point in time, or operating effectiveness across a period. See Type 1 vs Type 2.
- Observation window. A longer Type 2 period means more samples and more testing hours.
- Readiness state. Organised, retrievable evidence takes fewer auditor hours than a scramble. See readiness.
- Headcount and framework count. The software side of the bundle scales the way the rest of the category does, on people and on frameworks.
How to compare a bundle against platform plus firm
This is where most buyers get it wrong, and the error always runs the same direction. They compare a Thoropass bundle quote against a platform's published list price and conclude Thoropass is expensive. That comparison leaves the audit fee out of one side entirely, and the audit is not a rounding error. It makes the bundle look worse than it is by the entire cost of an engagement.
The comparison that works has three steps. Write your scope down once: system boundary, criteria, report type, observation window, deadline. Ask Thoropass to quote it. Then build the alternative as two lines, a platform quote plus a CPA firm quote for the same examination, and get the firm side from two or three firms rather than one. Now you have two totals that describe the same programme, and the comparison means something.
The published platform dimensions are a useful anchor for the software half of that second line. Secureframe and Sprinto both list a platform dimension at $7,500 for up to 100 employees; Drata lists $25,000 at the same band; Vanta lists Essentials at $14,000 for 1-20 employees, worded as a starting cost. All AWS Marketplace list prices, checked July 2026. What none of them include, and what you must add to make the comparison fair, is the audit.
What Thoropass Assurance is
The audit side of the bundle is delivered by Thoropass Assurance, the trading name of Laika Compliance, LLC. It is a licensed certified public accounting firm registered with the AICPA and it has been through AICPA peer review. The company positioning is on the Thoropass site at thoropass.com.
That matters because the obvious worry about a bundled audit is that you are getting a lesser deliverable. You are not. The report is issued under AT-C 205, the same examination standard that governs Schellman's reports and A-LIGN's and everyone else's, and a SOC 2 report has no discount version. The trade with Thoropass is commercial, not a question of whether the report counts.
The lock-in, stated plainly
With a platform-only vendor, your software choice and your auditor choice are independent. You can change firm at renewal and keep your evidence in place, or change platform and keep your firm. With Thoropass those are one decision. Changing auditor means leaving the platform, and rebuilding the GRC footprint at the same time as running a new firm's first-year engagement.
For most early-stage companies that is an abstract cost, because they have no auditor preference and no reason to acquire one. It becomes concrete in two situations: an IPO track where a different firm may be required, or a specific enterprise customer that names its acceptable auditors. Neither is common, both are expensive to discover late, and the time to price them is at signing rather than at year three.
Where the bundle genuinely earns its place
The one-vendor structure removes a real operational friction, and it is not marketing to say so. In the standard model you manage two contracts, two timelines and one evidence-sharing integration between a platform and an auditor's portal that mostly works. In the bundle, the auditor and the platform are the same operation, so the handoff does not exist to go wrong.
Whether that is worth what it costs is precisely what the three-step comparison above is for, and it will land differently for a ten-person company with no security hire than for a 300-person company with a GRC manager who runs auditor relationships for a living. This page is not going to tell you which you are. What it will tell you is that the comparison is only honest with the audit fee on both sides.