# Strike Graph - **Type:** Software product - **Website:** https://www.strikegraph.com - **Assessed by:** The Assurance Desk (Add-Venture Advisory Ltd) Compliance software your own team runs to map evidence to SOC 2, ISO 27001, ISO 42001, US HIPAA and other frameworks, with published prices. ## Strike Graph scores Scored 1 to 5 on six criteria. There is no overall score. ### Help when things go wrong: 1/5 Reviewed the homepage, the /secure-path methodology page and /trust-center: none describes support during a breach, an audit under regulatory scrutiny, or a continuous-monitoring/audit-trail capability framed around incident readiness. Closest statement found ("share ownership of security tasks across multiple teams") is about internal task management, not incident or regulator support. ### Qualifications of the people who do the work: 2/5 Strike Graph displays "SOC 2" and "HIPAA" achieved badges for its own company on its homepage and /trust-center, but publishes no narrative naming the audit type, scope, auditor or date, and claims no ISO 27001/42001 certification for itself despite selling those as customer modules, thinner disclosure than Drata (SOC 2 Type II, SOC 3, ISO 27001/17/18, ISO 42001, FedRAMP Class B, all named on a dedicated trust portal). ### What it publishes about fees: 5/5 strikegraph.com/pricing publishes four named tiers with explicit dollar starting prices ($0 / $10,000 / $21,500 / $35,000 per year) plus itemised add-on pricing for extra frameworks, HIPAA, penetration testing and third-party risk management, figures that direct competitors Drata and Vanta do not publish at all. ### Knowledge of your sector: 3/5 The platform covers sector-relevant frameworks (HITRUST for healthcare, DORA for financial services, CMMC for defense, TISAX for automotive) and lists customer logos on its homepage, but no dedicated named sector-specialist practice or quantified sector case study was found on the pages reviewed. ### Independence from what it sells: 2/5 Strike Graph's own SOC 2/HIPAA badges are shown without naming an independent auditing firm or a verifiable report, and its EU AI Act position statement is a self-declared assertion with no cited independent legal review, closer to marketing claim than independently attested fact, unlike Drata's named, independently audited SOC 2/ISO certifications. ### Who carries the risk if the advice is wrong: 2/5 Terms of Service disclose a clear numeric liability cap (12 months' fees) and mutual IP indemnification, which is more than nothing, but no professional indemnity insurance is disclosed anywhere and the uptime commitment is only "commercially reasonable efforts" rather than a numeric SLA or an explicit incident-support commitment. ## Sources for Strike Graph Every line carries the page it was read on and the date it was checked. - Legal entity, jurisdiction and HQ address - Source: https://data.sec.gov/submissions/CIK0001827335.json - Checked: 2026-09-20 - Founding and leadership - Source: https://www.strikegraph.com/about - Checked: 2026-09-20 - Product scope - Source: https://www.strikegraph.com - Checked: 2026-09-20 - Pricing disclosure - Source: https://www.strikegraph.com/pricing - Checked: 2026-09-20 - Own security certifications - Source: https://www.strikegraph.com/trust-center - Checked: 2026-09-20 - Liability, SLA and indemnification terms - Source: https://www.strikegraph.com/termsofservice - Checked: 2026-09-20 - Own AI-use and customer-data disclosure - Source: https://www.strikegraph.com/ai-security-assistant - Checked: 2026-09-20 ## What this provider publishes Not published means we did not find it on the firm's own pages. - Price: Published - Indemnity cover: Not published - Credentials: Published - Independent accreditation: Published - Client results: Not published - How it uses AI: Published ## Strengths - Publishes genuinely transparent pricing with real dollar figures across four tiers plus itemised add-on costs, unusual in this category, where direct competitors Drata and Vanta disclose no figures at all - Broad framework coverage spanning SOC 1/2, ISO 27001/27701/42001, HIPAA, HITRUST, GDPR, CCPA, the NIST family, CMMC, PCI DSS, DORA and TISAX in one platform - Makes a specific, checkable claim about its own AI stack, that it is private/zero-trust and that customer data is never used to train outside models, rather than a vague AI-safety statement - Publishes a standalone EU AI Act regulatory position statement addressing its own AI systems' regulatory status, which most competitors in this dataset do not do ## Things to check Each one carries the factual basis it rests on. - Strike Graph's own "SOC 2" and "HIPAA" badges carry no narrative disclosure of audit type, scope, certifying/auditing firm or certificate date, making its own compliance claim harder to independently verify than Drata's or Vanta's, which name the standard version and publish a dedicated trust portal. - Basis: Reviewed strikegraph.com/trust-center and the strikegraph.com homepage footer: both display certification badge images only, with no accompanying text naming an auditor, report type or date. - Strike Graph does not claim ISO/IEC 27001 or ISO/IEC 42001 certification for its own company or operations, even though it sells modules helping customers achieve exactly those standards. - Basis: strikegraph.com/trust-center and strikegraph.com/about list only SOC 2 and HIPAA as badges the company has itself "achieved"; ISO 27001/42001 appear elsewhere on the site solely as customer-facing product frameworks. - Its EU AI Act Regulatory Position Statement asserts its AI systems "currently operate outside the scope of the EU AI Act's regulatory requirements" as a broad, self-declared statement, without naming which specific AI features (Atlas AI, AI Security Assistant, VerifyAI) it covers or citing an independent legal assessment. - Basis: strikegraph.com/eu-ai-act-regulatory-position-statement makes this assertion in general terms with no feature-by-feature breakdown or named independent reviewer. - No professional indemnity insurance is disclosed anywhere in the public Terms of Service, and the only uptime commitment is "commercially reasonable efforts", not a numeric SLA. - Basis: strikegraph.com/termsofservice sets a 12-months'-fees liability cap and mutual IP indemnification but contains no PI-insurance clause and no percentage-based availability commitment. ## Where this firm appears - [Can the firm that prepares you also certify you?](https://theassurancedesk.com/best/certification-seeking) - [Does the EU AI Act apply to a UK firm?](https://theassurancedesk.com/best/eu-ai-act-exposed) - [How do you change your data protection provider?](https://theassurancedesk.com/best/switching-provider) - [Your sector adds its own rules to UK data protection law](https://theassurancedesk.com/best/sector-regulated) - [Which data protection, AI governance and cyber security providers publish a price?](https://theassurancedesk.com/lists/providers-that-publish-a-price) - [Compare providers](https://theassurancedesk.com/compare) --- **Scope.** The Assurance Desk covers data protection, AI governance and cyber security in the United Kingdom and the United States. It scores providers in both: UK-facing firms, and firms based in the United States. Every provider scored so far was selected for data-protection, AI-governance or security-assurance work. Where a page describes law, it names the country that law applies in. **Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here. **Corrections.** If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.