We count visits with Google Analytics cookies and Vercel Web Analytics to see which pages help readers most.

Cookie settings
The Assurance Desk

Strike Graph review

Software product

Compliance software your own team runs to map evidence to SOC 2, ISO 27001, ISO 42001, US HIPAA and other frameworks, with published prices.

Relevant if you want to run SOC 2 or ISO 27001 compliance yourself and know the price upfront

Price Published
Indemnity cover Not published
How it uses AI Published
Facts last checked

Not published means we did not find it on the firm's own pages.

Strike Graph scores

Six scores, each 1 to 5. The evidence for each is further down.

Help when things go wrong 1/5
Qualifications of the people who do the work 2/5
What it publishes about fees 5/5
Knowledge of your sector 3/5
Independence from what it sells 2/5
Who carries the risk if the advice is wrong 2/5

What Strike Graph offers, and what it publishes

Strike Graph publishes its prices. Launch is free; Certify starts at $10,000 a year, Scale at $21,500 and Enterprise at $35,000. Extras are priced too, including a US HIPAA add-on at $4,000-$5,000 a year and penetration testing at $10,000-$20,000. This is software your team runs, not advice, and it uses AI to help review evidence.

Strike Graph does not name the auditor, audit type or date behind its own 'SOC 2' and 'HIPAA' badges. It claims no ISO 27001 or ISO 42001 certification for itself. It does not publish indemnity cover or a numeric uptime commitment, only 'commercially reasonable efforts'. We found no client results.

Strike Graph says customer data is 'never used to train outside models', but does not name its model providers. Its position statement says its AI systems 'currently operate outside the scope of the EU AI Act's regulatory requirements', with no feature-by-feature breakdown or named independent reviewer. On Capterra it has 4.7 out of 5 from 9 reviews.

Strengths

  • Publishes genuinely transparent pricing with real dollar figures across four tiers plus itemised add-on costs, unusual in this category, where direct competitors Drata and Vanta disclose no figures at all
  • Broad framework coverage spanning SOC 1/2, ISO 27001/27701/42001, HIPAA, HITRUST, GDPR, CCPA, the NIST family, CMMC, PCI DSS, DORA and TISAX in one platform
  • Makes a specific, checkable claim about its own AI stack, that it is private/zero-trust and that customer data is never used to train outside models, rather than a vague AI-safety statement
  • Publishes a standalone EU AI Act regulatory position statement addressing its own AI systems' regulatory status, which most competitors in this dataset do not do

Things to check

  • Strike Graph's own "SOC 2" and "HIPAA" badges carry no narrative disclosure of audit type, scope, certifying/auditing firm or certificate date, making its own compliance claim harder to independently verify than Drata's or Vanta's, which name the standard version and publish a dedicated trust portal.
  • Strike Graph does not claim ISO/IEC 27001 or ISO/IEC 42001 certification for its own company or operations, even though it sells modules helping customers achieve exactly those standards.
  • Its EU AI Act Regulatory Position Statement asserts its AI systems "currently operate outside the scope of the EU AI Act's regulatory requirements" as a broad, self-declared statement, without naming which specific AI features (Atlas AI, AI Security Assistant, VerifyAI) it covers or citing an independent legal assessment.
  • No professional indemnity insurance is disclosed anywhere in the public Terms of Service, and the only uptime commitment is "commercially reasonable efforts", not a numeric SLA.

Common questions

Does Strike Graph publish its prices?

Yes. Launch is free, Certify starts at $10,000 a year, Scale at $21,500 and Enterprise at $35,000, with add-ons priced separately.

Is Strike Graph software or advice?

Software. Your team runs it to map evidence and controls to frameworks such as SOC 2 and ISO 27001.

Is Strike Graph itself certified to ISO 27001 or ISO 42001?

It does not claim either. It shows 'SOC 2' and 'HIPAA' badges for itself but does not name the auditor, audit type, scope or date.

Does Strike Graph publish a numeric uptime level or indemnity cover?

No. Its terms promise only 'commercially reasonable efforts' on uptime and disclose no professional indemnity insurance. They cap damages at the fees paid in the previous 12 months.

Evidence for each Strike Graph score

Show our working

Notes behind each thing to check

  • Strike Graph's own "SOC 2" and "HIPAA" badges carry no narrative disclosure of audit type, scope, certifying/auditing firm or certificate date, making its own compliance claim harder to independently verify than Drata's or Vanta's, which name the standard version and publish a dedicated trust portal. (Reviewed strikegraph.com/trust-center and the strikegraph.com homepage footer: both display certification badge images only, with no accompanying text naming an auditor, report type or date.)
  • Strike Graph does not claim ISO/IEC 27001 or ISO/IEC 42001 certification for its own company or operations, even though it sells modules helping customers achieve exactly those standards. (strikegraph.com/trust-center and strikegraph.com/about list only SOC 2 and HIPAA as badges the company has itself "achieved"; ISO 27001/42001 appear elsewhere on the site solely as customer-facing product frameworks.)
  • Its EU AI Act Regulatory Position Statement asserts its AI systems "currently operate outside the scope of the EU AI Act's regulatory requirements" as a broad, self-declared statement, without naming which specific AI features (Atlas AI, AI Security Assistant, VerifyAI) it covers or citing an independent legal assessment. (strikegraph.com/eu-ai-act-regulatory-position-statement makes this assertion in general terms with no feature-by-feature breakdown or named independent reviewer.)
  • No professional indemnity insurance is disclosed anywhere in the public Terms of Service, and the only uptime commitment is "commercially reasonable efforts", not a numeric SLA. (strikegraph.com/termsofservice sets a 12-months'-fees liability cap and mutual IP indemnification but contains no PI-insurance clause and no percentage-based availability commitment.)
Six criteria, each scored 1 to 5, with the evidence for each.
CriterionScoreEvidence
Help when things go wrong 1/5 Reviewed the homepage, the /secure-path methodology page and /trust-center: none describes support during a breach, an audit under regulatory scrutiny, or a continuous-monitoring/audit-trail capability framed around incident readiness. Closest statement found ("share ownership of security tasks across multiple teams") is about internal task management, not incident or regulator support.
Qualifications of the people who do the work 2/5 Strike Graph displays "SOC 2" and "HIPAA" achieved badges for its own company on its homepage and /trust-center, but publishes no narrative naming the audit type, scope, auditor or date, and claims no ISO 27001/42001 certification for itself despite selling those as customer modules, thinner disclosure than Drata (SOC 2 Type II, SOC 3, ISO 27001/17/18, ISO 42001, FedRAMP Class B, all named on a dedicated trust portal).
What it publishes about fees 5/5 strikegraph.com/pricing publishes four named tiers with explicit dollar starting prices ($0 / $10,000 / $21,500 / $35,000 per year) plus itemised add-on pricing for extra frameworks, HIPAA, penetration testing and third-party risk management, figures that direct competitors Drata and Vanta do not publish at all.
Knowledge of your sector 3/5 The platform covers sector-relevant frameworks (HITRUST for healthcare, DORA for financial services, CMMC for defense, TISAX for automotive) and lists customer logos on its homepage, but no dedicated named sector-specialist practice or quantified sector case study was found on the pages reviewed.
Independence from what it sells 2/5 Strike Graph's own SOC 2/HIPAA badges are shown without naming an independent auditing firm or a verifiable report, and its EU AI Act position statement is a self-declared assertion with no cited independent legal review, closer to marketing claim than independently attested fact, unlike Drata's named, independently audited SOC 2/ISO certifications.
Who carries the risk if the advice is wrong 2/5 Terms of Service disclose a clear numeric liability cap (12 months' fees) and mutual IP indemnification, which is more than nothing, but no professional indemnity insurance is disclosed anywhere and the uptime commitment is only "commercially reasonable efforts" rather than a numeric SLA or an explicit incident-support commitment.

Sources for Strike Graph

  • Legal entity, jurisdiction and HQ address (Strike Graph, Inc., a Delaware corporation (state of incorporation "DE" per SEC EDGAR), business and mailing address 999 Third Avenue, 33rd Floor, Seattle, WA 98104; confirmed via SEC EDGAR CIK 0001827335, which shows four Form D exempt-securities-offering filings dated 7 Oct 2020, 13 Sep 2021, 22 May 2023 and 19 Aug 2026) (data.sec.gov, checked 20 September 2026)
  • Founding and leadership ("Strike Graph was founded in 2020" by CEO Justin Beals; the about page lists investor logos including Madrona Ventures, Amplify and BAM Capital but no funding amounts) (strikegraph.com, checked 20 September 2026)
  • Product scope (Compliance-automation SaaS platform mapping evidence and controls to SOC 1/SOC 2, ISO 27001/27701/42001, HIPAA, HITRUST, GDPR, CCPA/CPRA, NIST CSF/800-53/800-171, CMMC, PCI DSS, DORA and TISAX, plus AI-driven features branded Atlas AI, AI Security Assistant and VerifyAI) (strikegraph.com, checked 20 September 2026)
  • Pricing disclosure (Publishes four named tiers with explicit dollar figures on its public pricing page: Launch (free), Certify ("starts at $10,000/yr"), Scale ("starts at $21,500/yr") and Enterprise ("starts at $35,000/yr"), plus itemised add-on pricing for extra frameworks, HIPAA add-on ($4,000-$5,000/yr), penetration testing ($10,000-$20,000) and third-party risk management ($7,500-$30,000+)) (strikegraph.com, checked 20 September 2026)
  • Own security certifications (Displays "SOC 2" and "HIPAA" achieved badges for itself on its homepage footer and trust-center page, but no accompanying narrative text names the audit type (Type I vs II), scope, certifying/auditing firm, or certificate date; ISO 27001 and ISO 42001 appear on the site only as frameworks Strike Graph helps customers achieve, not as its own certifications) (strikegraph.com, checked 20 September 2026)
  • Liability, SLA and indemnification terms (Public Terms of Service cap cumulative damages at fees paid by the customer in the preceding 12 months, commit only to "commercially reasonable efforts" for 24/7 availability (no numeric SLA percentage), disclaim liability for indirect/consequential damages, and set out mutual IP indemnification; no professional indemnity insurance is disclosed anywhere in the document) (strikegraph.com, checked 20 September 2026)
  • Own AI-use and customer-data disclosure (States: "All AI functionality runs on Strike Graph's private, zero-trust AI stack. Your data stays fully encrypted, never shared, and never used to train outside models", though it does not name the underlying model provider(s) or give data-retention specifics) (strikegraph.com, checked 20 September 2026)
  • Trustpilot: Trustpilot's own profile for strikegraph.com is claimed but shows 0 reviews ("This company hasn't received any reviews yet"), so it gives no usable signal. G2's review page (linked from Strike Graph's own site) returned a 403 error and could not be read. Clutch has no matching company profile for Strike Graph (Clutch's index skews toward agencies, not compliance SaaS). Capterra was the one accessible source with real data: 9 reviews averaging 4.7/5, describing Strike Graph as a cost-effective GRC platform for SOC 2/ISO 27001/HIPAA; reviewers consistently praise account-manager-led customer support and ease of reaching certification, while the recurring complaint is an outdated-feeling interface, limited third-party integrations, and a wish for better notifications on expiring controls/evidence. (Trustpilot, checked 20 September 2026)

Seeking ISO 42001 certificationRegulated sectorsExposed to the EU AI ActSwitching provider

Where this firm appears

If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.

This is an independent editorial guide, not legal advice.