# Thoropass - **Type:** Software product - **Website:** https://thoropass.com - **Assessed by:** The Assurance Desk (Add-Venture Advisory Ltd) US compliance software your team uses to gather audit evidence for SOC 2, ISO 27001 and ISO 42001, with an affiliated CPA firm doing the SOC 2 audit. ## Thoropass scores Scored 1 to 5 on six criteria. There is no overall score. ### Help when things go wrong: 2/5 Public status page shows a transparent incident log (no incidents in the last 3 months, 100% uptime) and a named AI-issue reporting channel routed to a Chief AI Officer with a 2-business-day response commitment, but no disclosed track record of handling a live security breach or regulatory investigation (status.thoropass.com, thoropass.com/report-an-incident-or-concern, checked 2026-09-20). ### Qualifications of the people who do the work: 5/5 Trust Center lists a 2025 SOC 2 Type 2 report, ISO 27001/27017/27018 certificate, ISO 27701, ISO 42001, a HITRUST e1 validated assessment, CREST pentesting membership and ISO 9001 (QMS), all as dated, downloadable documents (trust.thoropass.com, checked 2026-09-20). ### What it publishes about fees: 1/5 No pricing, rate card or worked example is published anywhere on thoropass.com; the /pricing URL redirects to the homepage (checked 2026-09-20). ### Knowledge of your sector: 4/5 Named Healthcare and SaaS practice pages, sector-relevant frameworks (HIPAA, HITRUST, PCI DSS), and named case studies (Cinchy, dealcloser) on thoropass.com/industries and thoropass.com (checked 2026-09-20). ### Independence from what it sells: 5/5 Thoropass's claims about its own security and AI-governance posture are backed by a genuine, dated SOC 2 Type II report and accredited ISO 27001/27701/42001 certificates plus a HITRUST validated assessment held for download in its Trust Center, not self-declared marketing text (trust.thoropass.com, checked 2026-09-20). ### Who carries the risk if the advice is wrong: 2/5 MSA discloses liability terms but caps aggregate liability at 12 months' fees (or $5,000), disclaims indirect damages, gives no SLA/uptime commitment and discloses no professional-indemnity or cyber-insurance cover (thoropass.com/msa/, checked 2026-09-20). ## Sources for Thoropass Every line carries the page it was read on and the date it was checked. - New York DOS record for Thoropass, Inc. (foreign business corporation) - Source: https://data.ny.gov/resource/n9v6-gdp6.json?dos_id=5563278 - Checked: 2026-09-20 - Thoropass's stated headquarters/business address - Source: https://thoropass.com/privacy-policy - Checked: 2026-09-20 - Thoropass's own security certifications, held as downloadable documents in its Trust Center - Source: https://trust.thoropass.com - Checked: 2026-09-20 - Thoropass became the first infosec-compliance platform certified to ISO/IEC 42001 (AI management systems) - Source: https://thoropass.com/company/newsroom - Checked: 2026-09-20 - Funding round (as Laika, Thoropass's former name) - Source: https://thoropass.com/company/newsroom - Checked: 2026-09-20 - Master Subscription Agreement liability and SLA terms - Source: https://thoropass.com/msa/ - Checked: 2026-09-20 - Thoropass Assurance (the affiliated CPA firm, formerly Laika Compliance) passed its most recent AICPA peer review - Source: https://thoropass.com/company/newsroom - Checked: 2026-09-20 ## What this provider publishes Not published means we did not find it on the firm's own pages. - Price: Not published - Indemnity cover: Not published - Credentials: Published - Independent accreditation: Published - Client results: Published - How it uses AI: Published ## Strengths - Holds a genuine, dated third-party SOC 2 Type II report plus accredited ISO 27001/27017/27018/27701/42001 certificates and a HITRUST e1 validated assessment, published for download in its own Trust Center rather than only claimed in marketing copy. - First infosec-compliance platform certified to ISO 42001 (AI management systems); names a Chief Artificial Intelligence Officer and runs a dedicated, anonymous-capable AI-incident reporting channel with a 2-business-day response commitment. - Its affiliated CPA firm, Thoropass Assurance, passed its most recent AICPA peer review with the highest rating, and its Independence and Excellence page names the specific AICPA independence rules and the December 2022 peer-review alert on 'self-review threat' it says it mitigates. - Named Healthcare and SaaS practice pages with specific customer case studies (Cinchy, dealcloser) and a public, transparent uptime-status page with an incident log. ## Things to check Each one carries the factual basis it rests on. - No pricing, rate card or worked cost example is published anywhere on the public site. - Basis: The /pricing URL redirects to the homepage and no fee figures appear on thoropass.com as of 2026-09-20. - Structural self-review risk: the same corporate family sells the compliance-readiness software and its affiliated CPA firm performs the SOC 2 audit built on that software's evidence. - Basis: Thoropass's own 'Independence and Excellence' page cites the AICPA's December 2022 peer-review alert warning that a SOC 2 tool with a 'related' CPA firm can create a self-review threat, and describes (without independent verification here) the safeguards it says mitigate this (thoropass.com/independence-and-excellence, checked 2026-09-20). - Customer-facing liability terms are minimal and there is no disclosed SLA or insurance. - Basis: The Master Subscription Agreement caps Thoropass's aggregate liability at 12 months' fees (or $5,000), disclaims indirect damages, states services are provided 'AS IS', and discloses no uptime commitment or professional-indemnity/cyber-insurance cover (thoropass.com/msa/, checked 2026-09-20). ## Where this firm appears - [Can the firm that prepares you also certify you?](https://theassurancedesk.com/best/certification-seeking) - [Your sector adds its own rules to UK data protection law](https://theassurancedesk.com/best/sector-regulated) - [Compare providers](https://theassurancedesk.com/compare) --- **Scope.** The Assurance Desk covers data protection, AI governance and cyber security in the United Kingdom and the United States. It scores providers in both: UK-facing firms, and firms based in the United States. Every provider scored so far was selected for data-protection, AI-governance or security-assurance work. Where a page describes law, it names the country that law applies in. **Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here. **Corrections.** If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.