Scytale vs Thoropass

Scytale is a compliance automation (GRC) platform that pairs its software with a dedicated in-house compliance expert for each customer. It was founded in 2021 by CEO Meiran Galis. The company is Israeli, with its R&D center in Tel Aviv and offices in New York, Prague, Lisbon, Johannesburg and Cape Town. The platform automates evidence collection, continuous control monitoring, user access reviews, policy management, vendor risk and audit preparation for security and privacy frameworks including SOC 2, ISO 27001, HIPAA, PCI DSS, GDPR and SOX IT general controls. The SOX capability came from its June 2025 acquisition of AudITech, a SOX ITGC automation startup. **AI compliance coverage** Scytale supports ISO/IEC 42001, reusing controls it shares with ISO 27001 to stand up an AI management system (AIMS), and added the EU AI Act as a framework in its platform in September 2025. Its AI agent, Scy, drafts answers to security questionnaires, reviews audit evidence and suggests fixes for control gaps; Scytale says Scy also helps with the NIST AI RMF through cross-mapped controls. It sells AI third-party risk management as a separate product. **Who it's for** Startups and mid-market companies that need SOC 2 or ISO 27001 and want to add ISO 42001 or EU AI Act readiness on the same platform, with expert help rather than purely self-serve software. Named customers include Deel, Intel, monday.com and Fiverr, mainly for security and privacy compliance; we found no published case study for its AI governance features.

Thoropass, which started as Laika, combines a compliance platform with its own auditors, so one company can prepare a customer for an audit and then perform it. It was founded in 2019 and is based in New York, with Sam Li as CEO and co-founder. It has raised about $98 million, most recently a $50 million Series C led by Fin Capital in November 2022. Audits run through Laika Compliance, LLC, a licensed CPA firm doing business as Thoropass Assurance, and in September 2026 a subsidiary, Thoropass Certification LLC, was accredited to perform ISO/IEC 27001:2022 certification audits. We found no acquisition or merger; its September 2026 announcement still names Thoropass, Inc. as the parent. Thoropass says it covers more than 30 frameworks, including SOC 1, SOC 2, ISO 27001, HITRUST, PCI DSS, HIPAA and CMMC, and also sells penetration testing, including tests of AI tools. Its AI features include First Pass AI, which pre-screens evidence before an auditor reviews it, and generative AI for due diligence questionnaires. **AI compliance coverage** Thoropass supports ISO/IEC 42001 readiness with policies, control sets and guided AI system impact assessment workflows, and says its ISO-qualified auditors are kept separate from implementation support. It doesn't list the EU AI Act or the NIST AI RMF. **Who it's for** Companies that want readiness and the audit itself from one vendor. Named customers include Nord Security, AcuityMD, PhysicsX and Access Group.