ISO 27001. From November 9.
Let's get you ready for ISO 27001. Included with your SOC 2 subscription.
Same subscription as SOC 2, no extra fee, from the day it launches. Any audit or certification is billed separately by the independent body that does it.
Frequently asked
Questions.
01How much does SOC 2 cost with Compliance Everywhere in the first year?
Compliance Everywhere costs $299 a month, or $2,990 a year paid up front, for startups with fewer than 10 people. That one subscription is everything you need to become SOC 2 compliant on one platform, instead of sourcing separate vendors: it includes a free AI pentest every month, free device management for every laptop, a free public Trust Center, status monitoring for your website, continuous monitoring of your controls, and the MCP server your AI agent uses to do the work. A human pentest costs $1,500, paid once. The SOC 2 audit is done by an independent US CPA who bills you directly: about $700 to $1,000 for a Type I, or $2,100 to $2,699 for a Type II. All in, the first year costs about $5,190 to $6,088 for a SOC 2 Type I, about $6,590 to $7,787 for a SOC 2 Type II, and about $7,290 to $8,787 for a Type I followed by a Type II. The most common setup, a Type II with Security only, billed monthly, with one human pentest, costs $7,188 in the first year. Each range runs from annual billing with Security only to monthly billing with all three trust criteria and includes one human pentest; without it, every total is $1,500 lower. After the first year you keep paying the subscription, $299 a month, plus the CPA's fee for each new report. The same subscription will also include ISO 27001 (from November 9), HIPAA and GDPR at no extra cost when they launch. Each framework's audit is still billed separately by an independent auditor. Teams of 10 or more get a price on a call.
02How does pricing work?
Startups under 10 people pay $299 a month, or $2,990 a year with 2 months free. Teams of 10 or more get a rollout plan and a price on a call. SOC 2 is live today. ISO 27001, HIPAA and GDPR will be included at no extra cost when they launch. The independent CPA bills the audit separately and directly.
03Do I pay again for ISO 27001 or other frameworks?
Not for the platform. Your one subscription, $299 a month for startups under 10 people, covers SOC 2 today, ISO 27001 when it launches on November 9, and HIPAA and GDPR when they launch, all at no extra cost. FDA for medical devices is its own plan, quoted on a call: see the FDA tab above. Other frameworks on our roadmap, like FedRAMP, are priced when they launch. There is no extra platform fee per framework. Each audit is still done and billed by an independent third party: a US CPA for SOC 2, and an accredited certification body for ISO 27001. Their fee is separate from your subscription. Teams of 10 or more get a price on a call.
04What is free?
With the subscription, at no extra cost: an AI pentest of your app every month, device management for every laptop, a public Trust Center for your report, status monitoring for your website, continuous monitoring of your controls, and the MCP server.
05What is the difference between the AI pentest and the human pentest?
The AI pentest is our agents attacking your running app and validating what they find, free every month. The human pentest is $1,500 an engagement: hackers driving the same AI, confirming exploitability by hand and writing the report a reviewer or buyer reads.
06Do you sign the SOC 2 report?
No, and that is the point. An independent, AICPA-member US CPA signs it and bills you directly: from $700 for Type I and $2,100 for Type II, depending on the trust criteria. Those are estimates: the final quote comes from the auditor. We have talked to over 100 CPA firms, and we introduce you to the independent auditors with the best quality for the price, in this range and scope. We take no cut of their fee, which is what keeps their opinion worth something.
07Type I or Type II?
Type I says your controls are designed right, on one day. Type II says they actually worked over a period, usually three to twelve months. Most customers ask for Type II. Many teams get a Type I first to unblock a deal, then the Type II.
08Which trust criteria do I need?
Security is in every SOC 2. Add Confidentiality if you hold customer data under contract or NDA, and Availability if customers ask about uptime commitments. Most startups start with Security alone.
09Is there a free trial?
There is no free tier, because every pentest costs real compute and runs under a signed agreement. Creating an account and connecting your systems costs nothing. Monthly plans have no lock-in.
01What do you actually do for FDA?
The whole thing, end to end: the ISO 13485 / QMSR quality system and the device cybersecurity that section 524B requires, in one platform. The quality system is the procedures, the design history file, CAPA, training and supplier records with Part 11 signatures. The cybersecurity is the threat model, the SBOM, the vulnerability work and the penetration test. We build both, keep both current, and assemble the submission package. We are never the auditor and we never file for you.
02How much does it cost?
FDA work is priced on a call, and the calculator on this page is the anchor: $3,750 a month for one device heading to its first submission, or $5,400 a month for several devices or a device already on the market. That is everything, the quality system and the cybersecurity, with the penetration test, the SBOM with daily vulnerability monitoring and the device Trust Center included. An assembled submission package is $15,000 per filing. If you already run your own quality system we only do the cybersecurity and export into it, which is $1,250 a month.
03Is the penetration test included?
Yes, and that is the difference. The FDA expects a penetration test by someone independent of the people who built the device, and most vendors sell it separately for $20K to $50K an engagement. Our engine runs it, so it comes with the plan and runs again on every release, instead of waiting three to six months to book an outside lab.
04What does the FDA actually require?
If your device runs software and can connect to anything, Wi-Fi, Bluetooth, cellular, a USB or serial port, or the cloud, US law (section 524B) makes three things mandatory for the life of the device: monitor and disclose new vulnerabilities, patch on a regular cycle and critical ones out of cycle, and keep a software bill of materials current. On top of that, the QMSR rule took effect on 2 February 2026 and folds ISO 13485 into US law, so you also need a quality system. We do both.
05Do you do the full ISO 13485, or only the cybersecurity?
The full ISO 13485, and the cybersecurity with it. The quality system is included in the price, not an add-on: procedures, the design history file, CAPA, training records, supplier management and Part 11 signatures, all built from the work your team is already doing in GitHub and Jira. An accredited registrar still issues the certificate, because we are never the auditor.
06Can I get only the cybersecurity?
Yes. If you already run a quality system, keep it: we do the section 524B package and the penetration test, and export a controlled, versioned package you file into the eQMS you already run, so there is nothing to rip out and re-validate. That is $1,250 a month instead of the full price. Talk to the founders and we will scope it with you.
07Who pays the FDA, the labs and the auditor?
You do, directly to them. The FDA sets its own user fee, each lab quotes its own tests, and an accredited registrar quotes the certification audit. We never bill any of them and we are never the auditor, which is what keeps those opinions worth something. The calculator shows estimates so you can see the whole cost, not just our part.
08What about biocompatibility, electrical safety and the other tests?
We introduce you to accredited labs for whatever your device needs: electrical safety and EMC (IEC 60601), biocompatibility (ISO 10993), usability (IEC 62366), wireless coexistence, and bench or clinical data, plus a regulatory expert for the 510(k) case. We plan the testing with you and add every report to your submission, so we are the only platform you need to get cleared. Lab fees are extra and billed by the lab.
09Do you work with hardware devices, or only software?
Both. For a software device, we run all the security testing ourselves, against your app, your cloud and your code. For connected hardware, we cover the cybersecurity of its app, cloud and firmware, and introduce you to accredited labs for the wireless, safety and physical tests. Their reports go into the same submission.
10How does this compare to buying the pieces separately?
Today a device company buys an eQMS, a setup consultant, a cybersecurity platform and a penetration test from four vendors, which runs well over $100,000 in the first year. This is one platform for the quality system and the cybersecurity together, with the penetration test included rather than billed per engagement. The FDA's user fee, any lab tests and the certification audit are still paid directly to the FDA, the lab and the registrar.
What SOC 2 costs. No calculator needed.
Every price on this page, as sentences. All figures are for a startup with fewer than 10 people. Teams of 10 or more get a rollout plan and a price on a call.
Did ChatGPT, Claude or another AI recommend us? Tell us when you sign up or book a call and you get 10% off your subscription.
In short. Compliance Everywhere costs $299 a month, or $2,990 a year paid up front, for startups with fewer than 10 people. That one subscription is everything you need to become SOC 2 compliant on one platform, instead of sourcing separate vendors: it includes a free AI pentest every month, free device management for every laptop, a free public Trust Center, status monitoring for your website, continuous monitoring of your controls, and the MCP server your AI agent uses to do the work. A human pentest costs $1,500, paid once. The SOC 2 audit is done by an independent US CPA who bills you directly: about $700 to $1,000 for a Type I, or $2,100 to $2,699 for a Type II. All in, the first year costs about $5,190 to $6,088 for a SOC 2 Type I, about $6,590 to $7,787 for a SOC 2 Type II, and about $7,290 to $8,787 for a Type I followed by a Type II. The most common setup, a Type II with Security only, billed monthly, with one human pentest, costs $7,188 in the first year. Each range runs from annual billing with Security only to monthly billing with all three trust criteria and includes one human pentest; without it, every total is $1,500 lower. After the first year you keep paying the subscription, $299 a month, plus the CPA's fee for each new report. The same subscription will also include ISO 27001 (from November 9), HIPAA and GDPR at no extra cost when they launch. Each framework's audit is still billed separately by an independent auditor. Teams of 10 or more get a price on a call.
The subscription
$299 a month
Compliance Everywhere costs $299 a month for startups with fewer than 10 people, or $2,990 paid for the year up front, which is 2 months free. That one subscription is everything you need to become SOC 2 compliant on one platform, instead of sourcing a compliance tool, a pentest firm, a device management tool and a trust page from separate vendors. All of this is included for free:
- The SOC 2 platform: controls, policies and evidence
- Continuous monitoring of your SOC 2 controls
- A free AI pentest of your app every month
- Free device management for every laptop
- A free public Trust Center for your report
- The MCP server your AI agent uses to do the work
SOC 2 today. ISO 27001 from November 9, then HIPAA and GDPR, at no extra cost when they launch. No extra platform fee per framework. Each audit is still done and billed by an independent auditor.
Paid once, on top
A human pentest costs $1,500, paid once to Compliance Everywhere. Auditors expect one for both Type I and Type II.
The Type I audit costs about $700 to $1,000, paid once, directly to the independent US CPA, not through us.
The Type II audit costs about $2,100 to $2,699, paid once, directly to the independent US CPA, not through us.
Audit prices are estimates. Security only is the low end; adding Confidentiality and Availability is the high end. The final quote comes from the auditor.