Vendor attestationActiveUnited States (AICPA)
SOC 2 (Service Organization Control 2)
SOC 2 is an AICPA auditing standard for service organizations, evaluating controls relevant to security, availability, processing integrity, confidentiality, and privacy. While not AI-specific, SOC 2 Type II reports are table stakes for B2B SaaS vendors — including AI governance platforms — and are frequently mapped to AI-specific risk frameworks.
This is an attestation a vendor obtains for its own operations — it is distinct from the AI-specific obligations the vendor’s tooling can help you meet. Vendors hold this certification or they don’t; we don’t use partial-coverage tiers here.
Standard owner
United States (AICPA)
Typical certification cycle
See overview
Penalty for misrepresentation
Loss of certification; legal exposure
Vendors that hold SOC 2
Vendors below have a current third-party attestation against this standard. We list the certification, not coverage levels.
12 vendors
| Vendor | HQ | Founded | Size | Pricing | Coverage | Last checked |
|---|---|---|---|---|---|---|
| Scrut Automation | Palo Alto, United States | 2021 | 51-200 | Contact for pricing | Certified | Sep 21, 2026 |
| Braintrust | San Francisco, United States | 2023 | 51-200 | Starter free ($0/mo, 1GB data/10k scores incl., overage $4/GB $2.50/1k); Pro $249/mo (5GB/50k incl., overage $3/GB $1.50/1k); Enterprise custom. | Certified | Sep 21, 2026 |
| WhyLabs | Seattle, United States | 2019 | 11-50 | Free tier for 1 model; $100/month for 2 models, scaling per model up to enterprise at $8,333/month (AWS Marketplace listing). | Certified | Oct 1, 2026 |
| Credo AI | Palo Alto, United States | 2020 | 51-200 | Contact sales for enterprise subscription quote. | Certified | Sep 21, 2026 |
| Arthur | New York, United States | 2019 | 51-200 | Free tier available; Premium at $60/mo; Enterprise custom, contact sales. | Certified | Sep 21, 2026 |
| Modulos AI Governance | Zurich, Switzerland | 2018 | 11-50 | Contact for pricing | Certified | Sep 21, 2026 |
| Harmonic Security | London, United Kingdom | 2023 | — | Three packages, Explore, Guide and Command (marked most popular), are listed on Harmonic's pricing page without prices; the page offers a demo. AWS Marketplace lists "Harmonic Security - Explore" at $163.00 per user per year on a 12-month contract, with a 200-user minimum and private offers for custom quotes. | Certified | Oct 15, 2026 |
| Nightfall AI | San Francisco, United States | 2018 | — | Two packages, priced per user per year: Foundation Edition (DLP across SaaS, email, AI apps and endpoints, with real-time blocking) and Premier Edition (adds AI agent security: hooks for Cursor, Claude Code and VS Code, MCP discovery, Claude Cowork and Claude Enterprise monitoring, SIEM export), offered as Tier 1 (up to 3 apps) or Tier 2 (all supported apps). The pricing page shows no amounts; it says final pricing depends on user count and data volume and offers a free 7-day proof of value. Each user license covers two endpoint devices. Data Discovery and Classification is an add-on with 150 GB included and paid 1 TB, 3 TB, 5 TB and 20 TB packs. | Certified | Oct 15, 2026 |
| Fiddler AI | Palo Alto, United States | 2018 | — | Three plans: Free (real-time guardrails for hallucinations, toxicity, PII/PHI, prompt injection and jailbreaks, powered by Fiddler's Centor models); Developer at $0.002 per trace (adds unified observability with tests and experiments for agentic and predictive systems, custom evaluators and bring-your-own judge, role-based access control and SSO; SaaS only); and Enterprise, priced by sales (adds enterprise-grade guardrails and scale, SaaS, VPC or on-premises deployment, and a named customer success manager). The pricing page lists no trace or user limits. | Certified | Oct 15, 2026 |
| Galileo | San Francisco, United States | 2021 | — | Sold as Splunk Agent Observability: Splunk lists it "starting at just $100 per month per 1.2 million spans annually, billed annually", including 500 million Luna tokens and 5 Luna fine-tuning runs a year; a free edition is linked. Galileo's own Free and Pro plans are no longer published (galileo.ai/pricing redirects to Splunk). | Certified | Oct 15, 2026 |
| Giskard | Paris, France | 2021 | — | No prices are published. Two plans: Open-source, a free Python library for local agent experiments with community support, and Professional, quoted on request ('Get your AI audited'). Professional adds automated audits with 50+ adversarial probes, evaluation dataset generation, SSO and role-based access, CI/CD integration through the SDK, on-premise, private cloud or SaaS deployment, and support with SLAs. Advisory on fixes and guardrails is an extra service. Giskard advertises a free Agentic Red Teamer trial with limited spots and an offer for startups and small teams, without stating terms for either. | Certified | Oct 15, 2026 |
| Knostic | Herndon, United States | 2023 | 11-50 | Kirin has three plans. Free is $0 a month for 1-5 users. Team is $15 per user per month for 5+ users and adds a dashboard, organization policy, role-based access and audit logs; advanced contextual detection costs extra. Enterprise is custom-priced for 10+ users and adds policy groups, SSO, SIEM and Slack integrations and compliance reporting. Team and Enterprise come with a 14-day free trial. AgentMesh threat intelligence has three plans: Free ($0 a month, login required), Premium ($15 per user per month, Kirin included) and Pro ($850 per user per month, unlimited API, Kirin included). AWS Marketplace still lists the older Copilot Readiness product at $50,000 per 12 months for the 'Knostic Tier', with usage above the base limit at $0.01 per unit. | Certified | Oct 15, 2026 |
Platforms that help you achieve SOC 2
Products that document support for running a SOC 2 program (evidence, controls, auditor workflows). This is product coverage, not the vendor’s own certification. Sorted by coverage level.
15 platforms
| Vendor | HQ | Founded | Size | Pricing | Coverage | Last checked |
|---|---|---|---|---|---|---|
| Aporia | San Jose, United States | 2019 | 51-200 | Enterprise pricing only. Not publicly listed. | Comprehensive | Apr 27, 2026 |
| Lasso Security | Tel Aviv, Israel | 2023 | 11-50 | Enterprise pricing only. Not publicly listed. | Comprehensive | Sep 21, 2026 |
| Pillar Security | Tel Aviv, Israel | 2023 | 11-50 | Enterprise pricing only. Not publicly listed. | Comprehensive | Sep 21, 2026 |
| Hyperproof | Bellevue, United States | 2018 | — | No public prices or plan names on its pricing page; quoted on request. The AI-native third-party risk product includes a baseline of AI credits, with more sold at discounted tiers. | Comprehensive | Oct 15, 2026 |
| Secureframe | San Francisco, United States | 2020 | 201-500 | Three plans: Fundamentals (starting at $7,500/year, one compliance framework), Complete (quote only; adds advanced versions of third-party risk, risk management, user access reviews, Trust Center and questionnaire automation, plus SSO/SCIM and custom integrations) and Defense (quote only; CMMC tooling such as SSP and POA&M). Additional workspaces are an add-on. | Comprehensive | Oct 15, 2026 |
| Sprinto | India | 2020 | — | No public prices. Three plans (Foundation, Growth, Platform) are quoted by sales. Foundation includes 25+ automated frameworks, 20 AI-powered security questionnaires a year and an AI systems inventory. Add-ons include additional frameworks, AI Governance, Enterprise Risk Management, Enterprise Trust Management and Enterprise Vendor Risk Management. | Comprehensive | Oct 15, 2026 |
| Thoropass | New York, United States | 2019 | — | No public prices or plan tiers. Services (Thoropass Audit, Audit-Ready Pentesting, Vulnerability Scanning, Compliance Suite) are sold on a tailored quote. | Comprehensive | Oct 15, 2026 |
| Drata | United States | 2020 | — | GRC plans (Foundation, Advanced, Enterprise) and Assurance plans (Trust Center and questionnaires) are quoted; drata.com shows no prices. Its AWS Marketplace listing charges a $25,000 platform fee for a 100-FTE organization plus $7,500 per framework, for a 12-month contract. | Comprehensive | Oct 15, 2026 |
| Vanta | San Francisco, United States | 2018 | 501-1000 | Four plans: Essentials, Plus, Professional and Enterprise. No prices on vanta.com; its AWS Marketplace listing gives 12-month starting prices for 1-20 employees: Essentials $14,000, Plus $21,500, Professional $23,000. Enterprise is quoted. Third-party risk management is a separate product ($13,600 a year for up to 50 vendors on AWS). | Comprehensive | Oct 15, 2026 |
| QL Security | United Kingdom | — | — | Contact for pricing | Partial | Sep 21, 2026 |
| Traccia | United States | — | — | Contact for pricing | Partial | Sep 21, 2026 |
| PrivacyScrubber | United States | — | — | Contact for pricing | Partial | Sep 21, 2026 |
| SetAIComply | European Union | — | — | Contact for pricing | Partial | Sep 21, 2026 |
| Attevera | European Union | — | — | Contact for pricing | Partial | Sep 21, 2026 |
| Meilynx | United States | — | — | Contact for pricing | Partial | Sep 21, 2026 |
Compare across industries
See which vendors support SOC 2 in your sector.
SOC 2 in Defense & National SecuritySOC 2 in EducationSOC 2 in Employment & HRSOC 2 in Energy & UtilitiesSOC 2 in Financial ServicesSOC 2 in Government & Public SectorSOC 2 in HealthcareSOC 2 in InsuranceSOC 2 in Legal ServicesSOC 2 in ManufacturingSOC 2 in Media & EntertainmentSOC 2 in Retail & E-commerceSOC 2 in SaaS & TechnologySOC 2 in Telecommunications
Last reviewed April 24, 2026. Informational summary only — not legal advice. Consult qualified counsel for specific obligations.