Secureframe vs Thoropass

Secureframe is a compliance automation (GRC) platform founded in January 2020 by Shrav Mehta and Natasja Nielsen. It is based in San Francisco, lists more than 200 employees across hubs in San Francisco, New York, Austin, Denver, Toronto and London, and has raised $79 million, most recently a $56 million Series B led by Accomplice in February 2022. The platform covers infrastructure monitoring, evidence collection, policy and risk management, vendor reviews and a Trust Center across more than 30 security, privacy and federal frameworks, including SOC 2, ISO 27001, HIPAA, CMMC and FedRAMP. Its AI features (Comply AI and Trust AI) draft questionnaire answers, suggest control mappings, score risks, pull answers from vendor SOC 2 reports, generate infrastructure-as-code fixes and check uploaded audit evidence. Its MCP server lets AI assistants such as ChatGPT, Claude and Cursor read compliance data. **AI compliance coverage** Secureframe added NIST AI RMF and ISO 42001 support in May 2024; its framework pages describe policy templates, pre-built tests, continuous monitoring and AI risk management for each. It says it added full support for the EU AI Act in September 2025, but has no dedicated EU AI Act page describing what is included. **Who it's for** Startups and mid-market companies, including defense contractors through its Defense plan, that want a published starting price. The case studies we found cover security and privacy frameworks, not AI governance.

Thoropass, which started as Laika, combines a compliance platform with its own auditors, so one company can prepare a customer for an audit and then perform it. It was founded in 2019 and is based in New York, with Sam Li as CEO and co-founder. It has raised about $98 million, most recently a $50 million Series C led by Fin Capital in November 2022. Audits run through Laika Compliance, LLC, a licensed CPA firm doing business as Thoropass Assurance, and in September 2026 a subsidiary, Thoropass Certification LLC, was accredited to perform ISO/IEC 27001:2022 certification audits. We found no acquisition or merger; its September 2026 announcement still names Thoropass, Inc. as the parent. Thoropass says it covers more than 30 frameworks, including SOC 1, SOC 2, ISO 27001, HITRUST, PCI DSS, HIPAA and CMMC, and also sells penetration testing, including tests of AI tools. Its AI features include First Pass AI, which pre-screens evidence before an auditor reviews it, and generative AI for due diligence questionnaires. **AI compliance coverage** Thoropass supports ISO/IEC 42001 readiness with policies, control sets and guided AI system impact assessment workflows, and says its ISO-qualified auditors are kept separate from implementation support. It doesn't list the EU AI Act or the NIST AI RMF. **Who it's for** Companies that want readiness and the audit itself from one vendor. Named customers include Nord Security, AcuityMD, PhysicsX and Access Group.