We count visits with Google Analytics cookies and Vercel Web Analytics to see which pages help readers most.

Cookie settings
The Assurance Desk

Hyperproof review

Software product

A US software platform that companies run to track audit evidence across more than 160 frameworks, including SOC 2, ISO 27001 and PCI DSS. It is not advice.

Relevant if you manage several frameworks and want one place for audit evidence

Price Not published
Indemnity cover Published
How it uses AI Published
Facts last checked

Not published means we did not find it on the firm's own pages.

Hyperproof scores

Six scores, each 1 to 5. The evidence for each is further down.

Help when things go wrong 2/5
Qualifications of the people who do the work 3/5
What it publishes about fees 1/5
Knowledge of your sector 4/5
Independence from what it sells 4/5
Who carries the risk if the advice is wrong 4/5

What Hyperproof offers, and what it publishes

Hyperproof publishes its contract terms. The subscription agreement promises 99.5% uptime, with service credits of 10 to 20% for misses, and caps liability at 12 months' fees, doubled for data protection claims. Its security page lists a SOC 2 report and a GDPR attestation from 360 Advanced, dated January 2025, with no findings.

Hyperproof does not publish a price; every pricing tier leads to a demo request. It publishes no ISO 27001 or ISO 42001 certificate for its own operations. It does not name its SOC 2 auditor or report type. Its leadership page lists 15 executives, none with a security title.

Capterra shows 4.8 out of 5 from 116 reviews, some vendor-referred. Reviewers praise evidence collection but mention a steep learning curve and high prices for small teams. Hyperproof says customer Acuity International cut its governance, risk and compliance workload by 70%. Its data supplier list tags Microsoft Azure, Google and Intercom/Fin for AI work, but names no AI model.

Strengths

  • Publishes a specific SLA (99.5% uptime) with tiered service credits and numeric liability caps, including a doubled cap for data-protection-related liability, rather than leaving availability and liability undefined.
  • Discloses a named third-party GDPR compliance attestation (360 Advanced, January 2025, no findings) in addition to a SOC 2 report, going beyond generic security marketing language.
  • Names distinct industry-vertical offerings (healthcare, fintech, aviation, manufacturing, technology) rather than one templated product for every sector.
  • Publishes named, quantified customer case studies (Acuity International: 70% reduction in GRC workload; Omnistruct: 660% increase in client service capacity) rather than only generic testimonials.

Things to check

  • No ISO/IEC 27001 or ISO/IEC 42001 certification is disclosed for Hyperproof's own operations, unlike close competitors Vanta, Drata, Secureframe and OneTrust, which all hold ISO 27001 and, for three of them, ISO 42001 too.
  • No CISO or other named security executive is published, weaker than Vanta (names CISO Jadee Hanson) and Secureframe (names CISO Drew Daniels).
  • No pricing figures are published anywhere on the site; every tier and page routes to a 'Get a Demo' request rather than a self-service quote or published rate card.
  • The subprocessor list flags Microsoft Azure, Google and Intercom/Fin as handling 'AI' processing but does not name the underlying AI model or foundation-model vendor, so a buyer cannot tell which model actually processes their data through Hyperproof AI.

Common questions

Does Hyperproof publish its prices?

No. Its pricing page shows no figures on any tier, and every button leads to a demo request.

Is Hyperproof itself certified to ISO 27001 or ISO 42001?

Not that it says. Its security page lists SOC 2, a GDPR attestation from 360 Advanced and FedRAMP Moderate for its separate government version, but no ISO 27001 or ISO 42001 certificate.

Which AI model handles customer data in Hyperproof?

It does not say. Its data supplier list tags Microsoft Azure, Google and Intercom/Fin as handling AI work, but names no AI model maker.

Which company is behind Hyperproof?

Hyperproof, Inc. Its subscription agreement calls it a Delaware corporation based in Seattle. Its last Form D filing with the US SEC, on 5 January 2021, gave Washington as its state of incorporation. We did not check a state register.

Evidence for each Hyperproof score

Show our working

Notes behind each thing to check

  • No ISO/IEC 27001 or ISO/IEC 42001 certification is disclosed for Hyperproof's own operations, unlike close competitors Vanta, Drata, Secureframe and OneTrust, which all hold ISO 27001 and, for three of them, ISO 42001 too. (hyperproof.io/security/, checked 2026-09-20, discloses only SOC 2, a GDPR third-party attestation and FedRAMP Moderate (Hyperproof Gov environment only); no ISO 27001 or ISO 42001 claim appears anywhere on that page.)
  • No CISO or other named security executive is published, weaker than Vanta (names CISO Jadee Hanson) and Secureframe (names CISO Drew Daniels). (hyperproof.io/about/, checked 2026-09-20, lists 15 named executives across CEO/COO/VP/SVP roles in sales, product, engineering, marketing and finance, none titled CISO or Head of Security.)
  • No pricing figures are published anywhere on the site; every tier and page routes to a 'Get a Demo' request rather than a self-service quote or published rate card. (hyperproof.io/pricing/, checked 2026-09-20, shows no dollar figures and only 'Get a Demo' / 'See Hyperproof in action' calls to action.)
  • The subprocessor list flags Microsoft Azure, Google and Intercom/Fin as handling 'AI' processing but does not name the underlying AI model or foundation-model vendor, so a buyer cannot tell which model actually processes their data through Hyperproof AI. (hyperproof.io/approvedsubprocessors/, checked 2026-09-20, tags Microsoft Azure, Google and Intercom/Fin with 'AI' but names no LLM/foundation-model provider anywhere on the page.)
Six criteria, each scored 1 to 5, with the evidence for each.
CriterionScoreEvidence
Help when things go wrong 2/5 Hyperproof markets Compliance Management, Risk Management, Audit Ops and Third-Party Risk modules generically on its homepage, but no specific claim about ICO engagement, EU AI Act enforcement scenarios or a breach-response service was found on the pages checked (home, security, pricing, MSA).
Qualifications of the people who do the work 3/5 Hyperproof discloses SOC 2 (Security/Availability/Confidentiality scope, Type and auditor unstated), a third-party GDPR attestation (360 Advanced, January 2025, no findings) and FedRAMP Moderate for its separate Gov environment, all independently checkable, but names no CISO or security executive and claims no ISO/IEC 27001 or ISO/IEC 42001 certification for itself.
What it publishes about fees 1/5 hyperproof.io/pricing publishes no dollar figures or tiers; every call to action is 'Get a Demo' or 'See Hyperproof in action', with pricing fully gated behind a sales conversation.
Knowledge of your sector 4/5 hyperproof.io/solutions names distinct offerings for Healthcare, Technology, Fintech, Aviation and Manufacturing verticals alongside a 160+ framework library (HIPAA, PCI DSS, SOC 2, ISO 27001, CMMC), though the depth of tailoring within each vertical page was not independently verified.
Independence from what it sells 4/5 Hyperproof's compliance claims about its own product rest on independent checks, a named third-party GDPR attestation from 360 Advanced (dated, no findings) and a SOC 2 report, rather than self-declared marketing, though it lacks an accredited ISO/IEC 27001 or 42001 certificate and does not name its SOC 2 auditor or report type, short of the strongest disclosure in this set (e.g. Vanta's ANAB-accredited ISO 42001 certification).
Who carries the risk if the advice is wrong 4/5 Hyperproof's Master Subscription Agreement discloses a 99.5% uptime SLA with 10-20% service credits and a numeric liability cap (fees paid in the preceding 12 months, doubled to 2x for data-protection-related claims), clear engagement and liability terms, though no named professional-indemnity insurance product was found.

Sources for Hyperproof

  • SEC EDGAR confirms the legal entity and CIK behind Hyperproof's Form D filings (Hyperproof Inc., CIK 0001758546, four Form D notices of exempt securities offerings filed 2018-2021; business address on the last filing (2021-01-05) was 10400 NE 4th St, Suite 500, Bellevue, WA 98004, with State of Incorporation shown as WA) (sec.gov, checked 20 September 2026)
  • Hyperproof's own Master Subscription Agreement states its current legal entity, jurisdiction and governing law ("Hyperproof, Inc., a Delaware corporation headquartered at 600 1st Ave Ste 330 PMB 78059 Seattle, Washington 98104"; governed by Delaware law with exclusive venue in Delaware state/federal courts) (hyperproof.io, checked 20 September 2026)
  • Own security certifications disclosed by Hyperproof (SOC 2 covering Security, Availability and Confidentiality trust-services criteria (report Type and auditor not named); a GDPR third-party attestation from 360 Advanced with no findings, dated January 2025; FedRAMP Moderate authorization limited to the separate 'Hyperproof Gov' environment) (hyperproof.io, checked 20 September 2026)
  • Pricing is not published anywhere on the site (hyperproof.io/pricing shows no dollar figures on any tier; every call to action reads 'Get a Demo' or 'See Hyperproof in action') (hyperproof.io, checked 20 September 2026)
  • Approved-subprocessor list names AI-tagged vendors but no foundation-model provider (14 subprocessors listed (AWS, Auth0, Microsoft Azure, Elastic, Google, Intercom/Fin, Merge, Okta, Planhat, PostHog, Segment, SendGrid, Sentry, Snowflake); Microsoft Azure, Google and Intercom/Fin are tagged as involved in 'AI' processing, with no OpenAI/Anthropic/other LLM vendor named anywhere on the page) (hyperproof.io, checked 20 September 2026)
  • SLA and liability terms are disclosed in the Master Subscription Agreement (99.5% uptime commitment with 10-20% service credits for misses; aggregate liability capped at fees paid in the preceding 12 months, doubled (2x) for data-protection-related liability) (hyperproof.io, checked 20 September 2026)
  • No CISO or named security executive appears on the leadership page (15 named executives are listed (CEO/Founder Craig Unger, COO, and 13 VP/SVP roles across sales, product, engineering, marketing, finance and support) with none titled CISO, Head of Security or equivalent) (hyperproof.io, checked 20 September 2026)
  • Trustpilot: No Trustpilot page exists for Hyperproof (a Trustpilot search returns only similarly named but unrelated companies). G2 blocked automated access and Clutch carries no listing for this product, but Capterra's own review page shows 4.8/5 from 116 reviews (some marked vendor-referred/incentivised), with reviewers praising centralised evidence collection and audit-readiness visibility and recurring complaints about a steep setup/onboarding learning curve, limited reporting customisation, and pricing that feels high for smaller teams. (Trustpilot, checked 20 September 2026)

SOC 2 (Security, Availability and Confidentiality) Third-party GDPR attestation (360 Advanced, January 2025) FedRAMP Moderate (Hyperproof Gov environment only)

Seeking ISO 42001 certificationRegulated sectors

Where this firm appears

If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.

This is an independent editorial guide, not legal advice.