SOC 2 Cost for a Small SaaS: Who Gets Paid, and for What

SOC 2 here means the report an accounting firm writes about a software company’s controls, the one a business customer asks a vendor to hand over before it signs. It is neither SOC 1 nor SOC 3, it is not the rest of the accounting profession’s SOC work, and it is not a security operations centre. This page is about the bill for that report, not about whether to get one and not about the work of getting ready for it.

The number is hard to pin down because there is no single number. A SOC 2 bill is at least two invoices and one payroll line, and most of what ranks for soc 2 compliance cost prices one of the three, then gestures at the other two. Everything below assumes the decision is already made, which for most owners it is not until a customer puts it in writing.

A SOC 2 bill has three payees: the CPA firm that examines the controls and writes the report, a compliance platform, which is optional and is not the auditor, and your own engineering time. Auditors and seller guides publish figures for the first. Of six compliance platforms checked, one publishes a price on its own pricing page.

Every fee below came off the page of the company that would be paid it, or, where marked as a seller guide, off a named seller’s published estimate of somebody else’s fee, pulled on 3 September 2026 in two ways, an ordinary automated request and one carrying a browser’s own identifiers, then read in the raw markup of the whole page including its navigation. Where a company publishes no number, the date it did not is written down instead of a guess. No two companies’ numbers are added together, averaged, or turned into a range here. Nobody at any of these firms was contacted, no audit was bought, no platform was signed up for, and no application belonging to anybody was opened for it.

Nothing here is legal advice, and nothing here is a verdict about whether a SOC 2 report is required in your situation, whether your app would pass one, or whether any of this applies to you. Every statement about the report, or about what an auditor does, is what a named page states on a named date.

One observation before the figures. On all three of the searches behind this page, run 3 September 2026, the first organic result was a Reddit thread titled “How much does it cost to obtain a SOC 2 Type 2 report?”, sitting above seven company-published pages on every pull. The thread could not be read by an automated request, so nothing inside it is quoted here; its position is the only thing it is cited for.

Who actually gets paid when you buy a SOC 2

Three parties send you something. Two of them send an invoice, and the third one is already on your payroll.

The CPA firm. A SOC 2 report is written by an accounting firm, and only by an accounting firm. The AICPA’s own page for the SOC family of reports, read on 3 September 2026, describes them as offerings CPAs provide around a service organisation’s system-level controls, and says CPAs use them “to provide assurance reports”. The word certification does not appear anywhere in the text that page rendered on 3 September 2026, its top navigation and its footer read as well; the only word of that family it renders is “Certified”, inside the footer line naming the Association of International Certified Professional Accountants. What you are buying from the firm is an opinion with a name signed under it, and that fee is the piece the market prices most openly.

The compliance platform. Vanta, Drata, Sprinto, Secureframe, comp.ai and Delve sell software that collects evidence, watches configuration, stores policies and produces the artefacts an auditor asks for. None of them writes the report. A platform subscription is not an audit fee, and buying one does not buy the other. The platform gathers the evidence; the CPA firm decides what the evidence shows and signs its name to the result. Plenty of companies get a report without ever buying a platform, and every platform still leaves you with a separate bill from a firm.

Your own engineering time. Nobody invoices this one, which is why it goes missing from a budget. Somebody has to produce the account list, prove who can reach which customer’s records, and show that changes reached production through a path a reviewer approved. If the app was built with an AI builder and nobody on the team has read the code end to end, that work does not shrink because the platform is good. It moves onto a person who can open the repository.

Those three are the whole bill. Everything else on a quote (a gap assessment, a penetration test, a tooling line, a training line) attaches to one of them, and the useful question about any number is which of the three it covers.

SOC 2 audit cost, from the firms that publish a number

Start with the only payee that publishes fees in public: the auditor.

Linford and Company LLP, an audit firm, publishes a SOC audit cost page that states its own range and midpoint. On that page, read 3 September 2026, the firm writes that “SOC audit costs typically range from $20,000 to $150,000, with a median price around $30,000”. The words typically and median are the firm’s own. That page also states: “If you are working with a big 4 accounting firm, you can expect SOC audit fees to start in the low six figures and go into the millions of dollars.” No number is attached to that sentence here. It says of itself that it “was originally published on 6/13/2018 and was updated on 2/4/2026”, while its own metadata carries a later modified date of 2026-04-16.

The rest of the published fees come from guides written by companies that sell compliance software or compliance services. Their numbers are worth reading because they are published and dated, and worth labelling because of who wrote them.

Those four seller guides were read at vanta.com/collection/soc-2/soc-2-audit-cost, drata.com/learn/soc-2/cost, workstreet.com/blog/soc-2-audit-cost and strongdm.com/blog/how-much-does-soc-2-cost, and zipsec’s, quoted further down, at zipsec.com/blog/how-much-does-soc-2-compliance-really-cost-a-clear-guide. Each of those companies sells into the market this page is pricing, so the addresses are printed and none of them is linked.

Two of those rows carry a note. Drata’s guide refused an ordinary automated request on 3 September 2026 and answered a browser-shaped one, so every Drata figure here was read from what the second request returned. Its summary line states “SOC 2 Type 2 audits cost $12,000 to over $100,000, depending on audit length, scope, and company complexity”, and the same page puts the whole first year, not the fee alone, at “$25,000 for a small startup to over $200,000 for a large enterprise”. Vanta’s guide, read the same day, gives the fee as $10,000 to $50,000 and the all-in first year as “$10,000 and $80,000 or more”, conditioned on company size, report type and how much of the business falls inside the audit; its summary table adds a row reading “Large enterprise with a Big Four firm” at “Low six figures and up”. Neither total is an audit fee, and neither belongs beside one.

What a Type 1 and a Type 2 cost, according to the sellers

Four of this page’s search phrasings ask about the two report types by price, so here is what each fetched page says about the difference, in its own numbers.

Drata’s page states that “SOC 2 Type 1 audits typically cost $7,500 to $15,000 for small to midsize companies and up to $60,000 for large organizations”, against the $12,000 to over $100,000 it gives for Type 2. StrongDM’s guide, dated 17 October 2025 on the page, abbreviates its thousands: “Expect the cost of an auditor for SOC 2 Type 1 to be in the $12k-$17k range.” Workstreet’s guide, dated 9 December 2025 on the page, is the one worth reading twice: it says: “A SOC 2 Type 1 audit will cost between $5,000-20,000 and SOC 2 Type 2 will cost between $10,000-$20,000 for small to mid-sized companies, for a large enterprise it can be $30,000-$100,000+.”

Read those two Workstreet ranges next to each other. The top of its Type 1 band sits above the bottom of its Type 2 band, which is the opposite of what most people expect from a report that covers a period rather than a moment. That is stated here as an observation about one published page on one date, with no conclusion drawn about the firm or about what any given quote will look like.

Which of the two reports to buy first is a separate call from what each one costs, and the customer’s exact wording usually settles it.

Compliance platform pricing, and what Vanta, Sprinto and Delve actually publish

Those guides price the auditor with some confidence. The companies selling the software in the same market mostly publish nothing about their own price.

Six compliance platforms had their own pricing pages fetched on 3 September 2026, with both request shapes, and read in the raw markup of the whole page including its navigation. One of the six publishes a figure.

The detail behind each row matters more than the row.

Secureframe is the exception. Its pricing page lists three packages. Fundamentals carries the figure $7,000/year with the words “Starting at” in front of it. Complete and Defense carry no figure at all, only a “Get a quote” button, and the rest of the page is a feature comparison between the first two.

Vanta’s pricing page at vanta.com/pricing names four plans and runs a long feature comparison beneath them, and no number appears on it. Its own instruction reads: “Request a free demo today to discuss your business needs and get personalized pricing.” Its buttons repeat the phrase. Both request shapes returned the same bytes.

Sprinto’s pricing page at sprinto.com/pricing/ refused an ordinary request on 3 September 2026 and answered a browser-shaped one. The page that came back is headed “Plans that meet you where you are”, names Foundation, Growth and Enterprise, marks several capabilities as add-ons, and prints no figure anywhere.

Drata has no pricing page at all. On 3 September 2026 the address drata.com/pricing refused an ordinary request and, to a browser-shaped one, resolved to the company home page, whose calls to action are a demo, contact sales, and get started. Drata’s cost guide ranked in the top three on all three searches behind this page.

comp.ai publishes no figure at trycomp.ai/pricing and explains why. Under the heading “Why don’t you publish a price list?” its page answers: “Because a flat rate would overcharge simple programs and undercharge complex ones.” The rest of the page is a form and a calendar.

Delve has no pricing page and no pricing route. The address delve.co/pricing returned 404 to both request shapes; the home page at delve.co returned 200 to both, and every link in its own navigation was read (product, framework, company, blog, partnership, press, careers, trust, login). None is a pricing page, and the word pricing does not appear in the rendered text of the home page. A $12,000 string does appear in that page’s markup, inside a mock product screenshot reading “$12,000 invoice due (HIPAA legal services)”. It is not a Delve price and should never be read as one.

So the searcher who types vanta soc 2 pricing or delve soc 2 pricing is looking for something that, on 3 September 2026, those companies do not publish. For five of the six, the platform line in a SOC 2 budget cannot be researched, and Secureframe’s one published figure is a starting price for its smallest package rather than a quote for your programme. The line has to be asked for, and asked for early, because its size is unknown until somebody quotes it.

The third payee is your own engineering time

The seller guides all name this line, and only one of them puts a number on it.

Vanta’s guide puts it plainly: “The audit fee is the smallest and most predictable part of that number. The money that moves your total lives in readiness work, security tooling, and the hours your own team spends getting ready.” zipsec’s guide, read the same day, sorts the same bucket into four parts: “The audit fee is usually only one slice of all-in SOC 2 cost. The remaining costs are tooling, deployment hours, readiness work, and internal staff time.”

That one is StrongDM, and the number it publishes is attached to a person. Its guide prints an itemised table with a cost column and a time column; its largest single line is a row labelled “Project Lead” at $75,000, inside a table totalling $147,000. StrongDM’s own words for that total are “we estimate the cost at $147,000 all-in”, which makes it that company’s estimate of its own scenario rather than a market figure. It is quoted because it is the only place in the fetched set where a seller writes down what the third payee costs.

What sits in that bucket is a set of jobs, and this is where an app built by an AI builder differs from the company those guides were written for. An examiner asks for evidence rather than for effort, and evidence comes out of a codebase, produced by somebody who can read it. The jobs, with no figure or day count attached to any of them:

Each is a question an examiner asks, and each has to be answered out of a codebase that whoever answers may not have written. Paying for the report is one question and doing the work behind it is another, and the second one lands on whoever can read the code.

The other line items the guides add, and where each one is priced

Quotes rarely arrive as three clean numbers. They arrive with extras attached, and each extra belongs to one of the three payees.

The gap or readiness assessment. Drata’s guide names it and prices it: “Gap Assessment ($5,000 - $25,000): A consultant or tool helps identify missing controls before the audit starts.” Workstreet’s guide names a differently scoped item, a “Readiness Assessment ($10,000-15,000)” which it describes as establishing whether an organisation is ready for audit. The two are not measurements of the same thing, and they appear here as two named line items from two named pages rather than as a range.

The penetration test. Some auditors and some customers ask for one, and it is a separate purchase from a separate kind of firm. No pen test figure appears on this page, because what a customer or auditor is actually asking for when a penetration test appears on the list is a decision with its own published prices and its own tradeoffs.

Security tooling. StrongDM’s table carries a “Tools” row at $30,000, on the same estimate as the rest of that table. Scanner and code review prices are not restated here either, because the pricing for that work sits with the five different jobs that get sold under one security label, where the bands and the tiers are already dated and named.

Legal review and training. StrongDM’s table prices these as separate rows: “Legal Review” at $10,000 and “Security Training” at $5,000. Both belong to that company’s own worked scenario, not to a quote anyone has given you.

The second year. zipsec’s guide says year-two spend “can run 40-60% below year one when automation stays in place”, with the condition attached to the sentence itself. It is worth saying who wrote it: zipsec sells compliance work, the automation the sentence credits is the category it sells, and the percentage is the seller’s own. The same page gives its all-in scenarios: “A first SOC 2 typically lands between $20,000 and $80,000 all-in for a small-company budget, ranging from a 20-person startup at roughly $46,500 for security-only to $162,500 for a 150-person SaaS company adding Availability.”

What the report is written against, and who is watching the market

The criteria a SOC 2 report is examined against come from the AICPA, and so does the only public commentary on the companies bundling reports with software.

The AICPA’s download page for the 2017 Trust Services Criteria, dated Sep 30, 2023 on the page and read on 3 September 2026, describes the document as presenting “control criteria established by the AICPA’s Assurance Services Executive Committee (ASEC) for use in attestation or consulting engagements to evaluate and report on controls over the security, availability, processing integrity, confidentiality, or privacy of information and systems”. The five things listed at the end of that sentence are the criteria categories, and they are the reason a quote changes when a customer asks for more than one of them. The document itself is a 554.3 KB file named Trust-services-criteria.pdf sitting behind a free account, so the page states what the file is and this page makes no claim to have read it.

The same body’s SOC landing page, read the same day, carries a notice about anonymously published allegations concerning one compliance vendor’s business practices, and points readers at its own 2026 material on business arrangements between CPA firms and SOC 2 tool providers. Four dated items sit beside it, published between February and May 2026. No vendor is named by the AICPA and none is named here, and none of that is a reason to distrust a bundled quote on its own. What it does is make one budgeting question worth asking out loud, and that question is the first of the three below. The fuller account of what the AICPA has been publishing about fast reports belongs on the page about the two report types, not on a page about the bill.

Three questions that tell you which payee a quote came from

A quote for compliance work usually arrives as one number with a paragraph attached. Three questions turn it back into three payees.

Who signs the report, and are they independent of the platform? The signature belongs to a CPA firm. If the platform introduced the firm, or the two are sold as one price, ask which entity is which and what the relationship is. The AICPA published its own ethics material on that exact subject in April 2026.

Which of the three payees does this number cover, and what does it exclude? One figure covering the platform, the auditor and a gap assessment is a different thing from an audit fee, and the guides above use the words differently on purpose. Vanta’s page keeps “audit fee” and “all-in cost” as separate rows. Ask which row you are being sent.

What does this fee assume about evidence you can already produce? This is where the third payee hides. An audit fee quoted on the assumption that access lists, change records and access logs already exist is a smaller number than the same audit against a codebase where none of it has been assembled. That gap is not the auditor’s problem and does not appear on their invoice.

One boundary is worth stating, given how much of this page is a list of people who send invoices. I am not one of them. It is not an auditor, not a compliance platform and not a consultancy, which is why it is not a payee here and is not a row in either table above.

A report is rarely the only thing on the list that arrived with the deal, and the rest of the list has its own answers.

Common questions about SOC 2 compliance cost

How much does a SOC 2 audit cost?

Published figures from the pages read on 3 September 2026: Linford and Company, an audit firm, states “SOC audit costs typically range from $20,000 to $150,000, with a median price around $30,000”. Vanta’s guide gives the audit fee alone as $10,000 to $50,000; Workstreet’s gives $10,000 to $50,000 for most startups and mid-market companies in 2026; Drata’s gives $12,000 to over $100,000 for a Type 2. Each is that company’s own published figure with its own label attached, and none of them is reconciled with the others here.

The table above prints each figure beside the company that published it, which is the only form in which they can be read together.

Why do published SOC 2 costs run from five figures to six?

Because the label covers different work. Linford’s page attributes the spread to the effort the assessment requires; Vanta’s conditions its total on company size, report type and how much of the business falls inside the audit; Drata’s conditions its Type 2 figure on audit length, scope and company complexity. A twenty-person product with one production system and a five-hundred-person company with several are both buying “a SOC 2”, and the word is doing very different work in the two sentences.

A SOC 2 price read off a guide is the shape of a market, not a quote. The quote arrives after somebody looks at the system in front of them.

Does a SOC 2 Type 2 report cost more than a Type 1?

Usually, on the published figures, though not in the same direction on every seller’s page. Drata prices Type 1 at “$7,500 to $15,000 for small to midsize companies and up to $60,000 for large organizations” against $12,000 to over $100,000 for Type 2. Workstreet gives $5,000-20,000 for Type 1 and $10,000-$20,000 for Type 2 for small to mid-sized companies, so its Type 1 top end sits above its Type 2 bottom end. Both read 3 September 2026.

Which report to buy is a different question from what each one costs, and it usually turns on the exact wording your customer used rather than on the fee difference. That decision has its own page.

What does a compliance platform charge on top of the auditor?

On 3 September 2026, one of the six platforms checked publishes a figure at all: Secureframe lists a package called Fundamentals at $7,000/year, labelled “Starting at”, with its two larger packages quote-only. Vanta, Sprinto and comp.ai publish no figure on their own pricing pages, and Drata and Delve keep no pricing page at all. Beyond that one starting figure, the platform line cannot be looked up; it has to be requested from each vendor.

Ask for the platform number before agreeing an audit date. Apart from Secureframe’s published starting price, it is the only one of the three payees whose price cannot be estimated from anything published.

Do I have to buy a compliance platform to get the report?

No. The report is written by a CPA firm; the platform is software that collects and organises the evidence the firm asks for. The AICPA’s own description of the SOC family, read 3 September 2026, names CPAs and controls, not software. Companies get reports without a platform, and companies with a platform still pay a firm separately.

What a platform changes is who assembles the evidence and how much of it is collected automatically. Whether that trade is worth its price depends on a quote most vendors will only give on request.

What does the second year cost?

zipsec’s guide states that year-two spend “can run 40-60% below year one when automation stays in place”, read 3 September 2026, with the condition written into the sentence. zipsec sells compliance work and the automation the sentence credits, which is stated here alongside the figure rather than after it. Vanta’s guide makes a related point without a percentage: audits happen every year, so the number you land on is a recurring cost rather than a one-time bill.

No second-year figure is offered here beyond what those pages publish. The structural point is that all three payees recur: the audit fee annually, the subscription annually, and the engineering time at whatever level evidence collection actually needs.

Does a penetration test have to be in the budget?

Sometimes, depending on who is asking and for what. Drata’s worked startup scenario includes a penetration test in its total, and some customers ask for one directly rather than through the audit. It is bought from a different kind of firm than the auditor and priced separately from everything in the two tables above.

What each kind of test costs, and which kind a request actually accepts, is settled on the page about choosing between a penetration test, a code review, or both, which prices that work where this page does not.

Why will most compliance platforms not publish a price?

comp.ai is the only one of the six that answers the question on its own page. Under the heading “Why don’t you publish a price list?” its page says: “Because a flat rate would overcharge simple programs and undercharge complex ones.” It gives the example of a twenty-person startup pursuing one framework against a five-hundred-person company running three. Read 3 September 2026.

Whether that reasoning holds for the other four is not something this page can say, because none of them addresses it. What is observable is that two of them run a full feature comparison and then send you to a form, and two keep no pricing page at all.

Who does the engineering work if nobody here wrote the app?

Somebody who can read the code, which for an app built on an AI builder is often nobody currently on the team. The evidence an examiner asks for (account lists, proof of who can reach which customer’s data, a record of how changes reached production, access logs) comes partly out of the codebase and partly out of the accounts, admin consoles, CI and log systems where those records live, and a record of how a control operated over a period cannot be reconstructed from code. A platform can tell you a control is unmet. It cannot open the repository and make it met.

That is the part of the bill that never arrives as an invoice, and it is a large enough subject on its own: what the controls actually require of an AI-built codebase, control class by control class, is a separate question from what any of it costs.