We count visits with Google Analytics cookies and Vercel Web Analytics to see which pages help readers most.

Cookie settings
The Assurance Desk

Thoropass review

Software product

US compliance software your team uses to gather audit evidence for SOC 2, ISO 27001 and ISO 42001, with an affiliated CPA firm doing the SOC 2 audit.

Relevant if you want one tool to hold your SOC 2, ISO 27001 and ISO 42001 evidence

Price Not published
Indemnity cover Not published
How it uses AI Published
Facts last checked

Not published means we did not find it on the firm's own pages.

Thoropass scores

Six scores, each 1 to 5. The evidence for each is further down.

Help when things go wrong 2/5
Qualifications of the people who do the work 5/5
What it publishes about fees 1/5
Knowledge of your sector 4/5
Independence from what it sells 5/5
Who carries the risk if the advice is wrong 2/5

What Thoropass offers, and what it publishes

This is software your team runs, not advice. It collects the evidence for SOC 2, ISO 27001, ISO 42001 and HITRUST audits, and an affiliated CPA firm, Thoropass Assurance, does the SOC 2 audit. Thoropass puts its own dated SOC 2 report and ISO certificates up for download in its Trust Center.

Thoropass does not publish a price. There is no rate card or worked example, and its pricing page sends you to the homepage. Its subscription agreement states no uptime commitment and discloses no professional indemnity or cyber insurance.

The software and the auditor are in the same corporate family. Thoropass's site cites a December 2022 AICPA alert that this can create a 'self-review threat', and describes safeguards we have not verified. Its agreement caps liability at 12 months' fees, or $5,000 if none were paid. The audit firm passed its latest peer review, reported December 2025.

Strengths

  • Holds a genuine, dated third-party SOC 2 Type II report plus accredited ISO 27001/27017/27018/27701/42001 certificates and a HITRUST e1 validated assessment, published for download in its own Trust Center rather than only claimed in marketing copy.
  • First infosec-compliance platform certified to ISO 42001 (AI management systems); names a Chief Artificial Intelligence Officer and runs a dedicated, anonymous-capable AI-incident reporting channel with a 2-business-day response commitment.
  • Its affiliated CPA firm, Thoropass Assurance, passed its most recent AICPA peer review with the highest rating, and its Independence and Excellence page names the specific AICPA independence rules and the December 2022 peer-review alert on 'self-review threat' it says it mitigates.
  • Named Healthcare and SaaS practice pages with specific customer case studies (Cinchy, dealcloser) and a public, transparent uptime-status page with an incident log.

Things to check

  • No pricing, rate card or worked cost example is published anywhere on the public site.
  • Structural self-review risk: the same corporate family sells the compliance-readiness software and its affiliated CPA firm performs the SOC 2 audit built on that software's evidence.
  • Customer-facing liability terms are minimal and there is no disclosed SLA or insurance.

Common questions

Does Thoropass publish its prices?

No. It publishes no prices, rate card or worked example, and its pricing page redirects to the homepage.

Does the company that sells the software also do the audit?

Yes. Thoropass Assurance, an affiliated CPA firm formerly called Laika Compliance, performs the SOC 2 audit on evidence gathered in Thoropass's software. Thoropass's site cites a December 2022 AICPA alert about this 'self-review threat' and describes safeguards it says address it.

Does Thoropass hold an AI certification?

Yes. It announced ISO/IEC 42001 certification, the AI management-system standard, on 22 October 2024, and says it was the first infosec-compliance platform to hold it. It also names a Chief Artificial Intelligence Officer and runs an AI-incident reporting channel with a 2-business-day response commitment.

Does Thoropass promise uptime or disclose insurance?

No. Its subscription agreement states no uptime commitment, provides the service 'AS IS', and discloses no professional indemnity or cyber insurance. Liability is capped at 12 months' fees, or $5,000 if none were paid.

Evidence for each Thoropass score

Show our working

Notes behind each thing to check

  • No pricing, rate card or worked cost example is published anywhere on the public site. (The /pricing URL redirects to the homepage and no fee figures appear on thoropass.com as of 2026-09-20.)
  • Structural self-review risk: the same corporate family sells the compliance-readiness software and its affiliated CPA firm performs the SOC 2 audit built on that software's evidence. (Thoropass's own 'Independence and Excellence' page cites the AICPA's December 2022 peer-review alert warning that a SOC 2 tool with a 'related' CPA firm can create a self-review threat, and describes (without independent verification here) the safeguards it says mitigate this (thoropass.com/independence-and-excellence, checked 2026-09-20).)
  • Customer-facing liability terms are minimal and there is no disclosed SLA or insurance. (The Master Subscription Agreement caps Thoropass's aggregate liability at 12 months' fees (or $5,000), disclaims indirect damages, states services are provided 'AS IS', and discloses no uptime commitment or professional-indemnity/cyber-insurance cover (thoropass.com/msa/, checked 2026-09-20).)
Six criteria, each scored 1 to 5, with the evidence for each.
CriterionScoreEvidence
Help when things go wrong 2/5 Public status page shows a transparent incident log (no incidents in the last 3 months, 100% uptime) and a named AI-issue reporting channel routed to a Chief AI Officer with a 2-business-day response commitment, but no disclosed track record of handling a live security breach or regulatory investigation (status.thoropass.com, thoropass.com/report-an-incident-or-concern, checked 2026-09-20).
Qualifications of the people who do the work 5/5 Trust Center lists a 2025 SOC 2 Type 2 report, ISO 27001/27017/27018 certificate, ISO 27701, ISO 42001, a HITRUST e1 validated assessment, CREST pentesting membership and ISO 9001 (QMS), all as dated, downloadable documents (trust.thoropass.com, checked 2026-09-20).
What it publishes about fees 1/5 No pricing, rate card or worked example is published anywhere on thoropass.com; the /pricing URL redirects to the homepage (checked 2026-09-20).
Knowledge of your sector 4/5 Named Healthcare and SaaS practice pages, sector-relevant frameworks (HIPAA, HITRUST, PCI DSS), and named case studies (Cinchy, dealcloser) on thoropass.com/industries and thoropass.com (checked 2026-09-20).
Independence from what it sells 5/5 Thoropass's claims about its own security and AI-governance posture are backed by a genuine, dated SOC 2 Type II report and accredited ISO 27001/27701/42001 certificates plus a HITRUST validated assessment held for download in its Trust Center, not self-declared marketing text (trust.thoropass.com, checked 2026-09-20).
Who carries the risk if the advice is wrong 2/5 MSA discloses liability terms but caps aggregate liability at 12 months' fees (or $5,000), disclaims indirect damages, gives no SLA/uptime commitment and discloses no professional-indemnity or cyber-insurance cover (thoropass.com/msa/, checked 2026-09-20).

Sources for Thoropass

  • New York DOS record for Thoropass, Inc. (foreign business corporation) (DOS ID 5563278; jurisdiction Delaware; initial NY filing date 2019-06-03; process address 632 Broadway, Suite 801, New York, NY 10012) (data.ny.gov, checked 20 September 2026)
  • Thoropass's stated headquarters/business address (228 Park Ave S, PMB 41082, New York, NY 10003, United States) (thoropass.com, checked 20 September 2026)
  • Thoropass's own security certifications, held as downloadable documents in its Trust Center (2025 SOC 2 Type 2 Report; ISO 27001/27017/27018 certificate awarded 9.3.2025; ISO 27701 certificate; HITRUST e1 validated assessment (2026); CREST membership certificate) (trust.thoropass.com, checked 20 September 2026)
  • Thoropass became the first infosec-compliance platform certified to ISO/IEC 42001 (AI management systems) (ISO 42001 certification announced 22 October 2024) (thoropass.com, checked 20 September 2026)
  • Funding round (as Laika, Thoropass's former name) ($50M Series C raised 8 November 2022, investors including Bain Capital Ventures, JPMorgan and PayPal Ventures) (thoropass.com, checked 20 September 2026)
  • Master Subscription Agreement liability and SLA terms (Aggregate liability capped at fees paid in the prior 12 months (or $5,000 if none paid); indirect/consequential damages excluded; hosted services provided 'AS IS'; no uptime/SLA commitment stated) (thoropass.com, checked 20 September 2026)
  • Thoropass Assurance (the affiliated CPA firm, formerly Laika Compliance) passed its most recent AICPA peer review (Highest possible rating ('pass'), reported December 2025) (thoropass.com, checked 20 September 2026)

SOC 2 Type II ISO 27001 ISO 27017 ISO 27018 ISO 27701 ISO/IEC 42001 ISO 9001 HITRUST e1 validated assessment CREST membership

Seeking ISO 42001 certificationRegulated sectors

Where this firm appears

If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.

This is an independent editorial guide, not legal advice.