How we price year one of SOC 2
How SOC 2 Compared works out one year-one figure for every compliance platform at 25 employees, and why the audit is always its own line.
A SOC 2 platform’s price page rarely answers the question a founder brings to it: what will the first year cost us? Prices are annual and set by headcount bands. Some charge for the first framework on top of the platform. Some add an onboarding fee. Half the market publishes no price at all. And the audit, which a licensed CPA firm performs, is sometimes included, sometimes sold beside the plan and most often left to you.
So every platform here carries one figure: year one for a 25-person company, one framework, on the vendor’s own published prices. We also show 100 people.
The standard company
- 25 employees. It sits inside the first headcount band of the platforms that publish bands, so the figure prices the plan a small company would buy. The second figure uses 100.
- One framework: SOC 2.
- The first 12 months from signing, with one-time onboarding inside them.
Inside the figure
The cheapest published plan whose headcount band holds 25 people, plus any fee the buyer cannot decline: the first framework where it is priced apart, per-person charges, and a one-time onboarding or implementation fee. Each part is named on the listing, with the vendor page it was read on.
A price must be published by the vendor on its own site or on its own public AWS Marketplace listing. A price someone else reported is not a list price, and we never put one inside a figure.
Outside it
The audit is a line of its own. When the plan includes it, the listing says so and names the firm. When the vendor publishes a partner’s audit price, it sits beside the figure. Otherwise it reads “not included”. Further frameworks, optional add-ons and a headcount past the plan’s band are outside too.
When there is no figure
A vendor that sells only through sales gets no figure. A plan priced only for a smaller company, such as 1 to 20 employees, is said as such instead of stretched to 25.
Audit firms
Audit firms are listed with what a buyer checks first: the firm’s license, its most recent peer review in the AICPA’s public file, what it publishes about its price and how long an audit takes.
What we do not do
SOC 2 Compared compares software and services. It is not legal, audit or security advice, and a listing is not an endorsement. We never say a platform or a report makes a company compliant or secure.