.svg)
.svg)
Thoropass’s AI-powered Audit Lifecycle Platform brings scope, evidence, requests, reviews, issues, and milestones into one centralized workspace. Everything stays connected, so your audit moves faster with fewer surprises.
Meet your dedicated auditor before the audit begins. Equipped with proprietary AI tools and backed by deep audit expertise, they help define scope, review controls, and answer questions from day one - making the entire audit faster, smoother, and more predictable.
Start with SOC 2, then reuse controls, evidence, and policies across ISO 27001, PCI DSS, HIPAA, HITRUST, and more. Expand your compliance program without starting from scratch.
Whether your evidence comes from Thoropass, another GRC, or a spreadsheet, Smart Sort automatically maps it to the right audit requests, helping your auditor review faster and reducing manual effort.
Policy templates, auditor-approved custom controls, monitors, integrations, and more. With everything you need to build a robust security program, Thoropass has your back.
all-in-one
We were unhappy with the previous provider that we picked for many reasons, but most importantly, it was the auditor and the platform being separate.”
With its holistic approach to security and compliance, a seamless platform, and hands-on support, Thoropass was the partner Opstream needed.
Product
SOC 2
Industry
B2B Software, Procurement
Company size
11-50
Location
United States
Mor Cohen-Tal
CTO and Co-founder
Opstream
seamless experience
With Thoropass’s seamless audit experience, we were able to get the audit done in a fraction of the time.
Capitalize CTO Chris Phillips could work with any auditor, but chose Thoropass because of its exclusive inclusion of in-house expertise.
Product
SOC 2
Industry
Fintech
Company size
50-100
Location
United States
Capitalize
frictionless compliance
The audit process was absolutely painless, and Thoropass made our three weeks less of a headache.
Wayleadr chose Thoropass as their trusted compliance platform due to the closed-loop solution of powerful software and human expertise.
Product
SOC 2
Industry
Software Development
Company size
26-50
Location
Ireland, United States
Wayleadr
growth through quality support
If my previous audits were offered to me for free, I would still use Thoropass
Stylo’s co-founder and CTO Josh Horowitz enjoyed exponential growth after enjoying his audit and support experience with Thoropass.
Product
SOC 2
Industry
Artificial Intelligence, Computer Software
Company size
26-50
Location
United States
Josh Horowitz
Co-founder & CTO
Stylo
Streamline your operations and build trust with customers by working toward SOC 1 compliance with Thoropass.
SOC 2 is an independent audit report that evaluates whether a service organization has controls in place to protect customer data. It is commonly requested of SaaS, technology, and cloud-based companies because it helps customers assess how an organization manages security, availability, confidentiality, processing integrity, and privacy.
A SOC 2 Type I audit evaluates the design of controls at a specific point in time. It helps show whether the right controls are in place as of the report date.
A SOC 2 Type II audit evaluates both the design and operating effectiveness of controls over a review period, often 3 to 12 months. It helps show whether controls are not only designed appropriately, but also operating consistently over time.
SOC 1 evaluates controls that could impact a customer's financial reporting. It is primarily intended for organizations such as payroll providers, payment processors, and financial service providers whose services affect their customers' financial statements.
SOC 2 assesses an organization's controls for protecting customer data based on the Trust Services Criteria. It is the most widely requested audit for B2B SaaS and technology companies.
SOC 3 is a public-facing summary of a successful SOC 2 audit. It confirms that an organization has met the applicable Trust Services Criteria without including the detailed control descriptions and testing results found in a SOC 2 report, making it suitable for websites and marketing materials.
Controls are the policies, procedures, systems, and activities an organization uses to reduce risk and meet audit criteria. In a SOC 2 audit, controls are evaluated against the Trust Services Criteria included in the audit scope.
The Trust Services Criteria are the categories used to evaluate controls in a SOC 2 audit. They include Security, Availability, Confidentiality, Privacy, and Processing Integrity. Every SOC 2 audit includes Security, and additional criteria may be added based on customer requirements and business needs.
SOC 2 audit costs vary based on scope, company size, systems included, Trust Services Criteria, audit type, and the length of the review period. Thoropass helps make the process more predictable by defining scope early, managing the audit lifecycle in one place, and guiding the engagement through final report delivery.
Working with Thoropass gives your team access to experienced SOC 2 auditors equipped with proprietary AI tools that automate repetitive tasks, accelerate evidence review, and surface insights throughout the audit. Combined with our Audit Lifecycle Platform for managing requests, evidence, comments, issues, and reporting, you get a faster, more transparent audit experience without compromising quality or rigor.
Ongoing SOC 2 audit readiness means keeping the controls, documentation, and evidence needed for future SOC 2 audits organized and current. For Type II audits in particular, organizations need to show that controls operated effectively over the review period, so consistent preparation can make future audit cycles more efficient.
Close
Leith Khanafseh
Audit Managing Partner, Thoropass Assurance
Leith founded and leads Thoropass’s Assurance practice, bringing 15 years of audit experience to the role. At Thoropass, he oversees the audit and assessment offerings, shapes product direction, and drives innovation that modernizes traditionally outdated audit practices.
Matt Udicious
Director of Infosec Assurance
Matt is a seasoned InfoSec assurance professional with over a decade of experience in cybersecurity, specializing in security, auditing, and compliance.
Matt’s career has included roles, across security, auditing, and compliance. He gained invaluable insights during his tenure as a former auditor, concentrating on SOC 2 compliance for technology companies within the prestigious Big 4 consulting firms. His meticulous approach and deep understanding of industry standards have made him a trusted authority in information security.
Bruce Edwards
Senior Manager, PCI Assurance
Bruce has more than 15 years of experience in security and risk management, both as an external consultant and an internal practitioner. His experience includes penetration testing, PCI QSA, ASV, and cloud security, and in his previous role as a security director, Bruce led PCI DSS assessments for Fortune 500 companies in the fintech and healthcare sectors, both in the U.S. and around the world.
.avif)
Lucas Baiocchi
Senior Manager, HITRUST InfoSec Assurance
Lucas has more than eight years of experience in information security audits and assessments. As Thoropass’ HITRUST InfoSec Assurance Senior Manager, he leads and executes HITRUST assessments, working closely with organizations to evaluate their security posture, validate control effectiveness, and deliver clear, actionable insights that align compliance objectives with broader business goals. His approach ensures not only regulatory and standards-based compliance, but also the adoption of efficient, scalable, and realistic security solutions.
Tom Miller
Senior Manager, Enterprise Team, InfoSec Solutions
Tom is an information security and technology audit leader with more than a decade of experience delivering assurance engagements for organizations ranging from large public corporations to high-growth startups. He owns Thoropass’ largest and most strategic client portfolio, leading complex multi-framework audits and serving as a trusted advisor to executive stakeholders on control design, security requirements, and remediation strategy.
Chris Beiro
Senior Director, InfoSec Solutions
Chris is a seasoned cybersecurity executive with over 15 years’ experience in compliance and audit. He has helped hundreds of organizations – from high-growth startups to Fortune 500 enterprises - strengthen their cybersecurity programs, meet rigorous compliance standards, and mitigate risk. Prior to joining Thoropass, he spent more than 13 years in cybersecurity and audit leadership roles at KPMG and Coalfire.
Austin Newcomer
Senior Manager, InfoSec Assurance
Austin is a Senior Information Assurance leader with more than eight years of experience and expert-level command of AICPA attestation standards. Prior to joining Thoropass, he spent three years at IT auditor Coalfire, where he supported clients ranging from Silicon Valley startups to Fortune 100 corporations.
Today, he leads more than 40 concurrent SOC 1, SOC 2, and HIPAA audits for emerging, mid-market, and enterprise technology companies, with particular depth in healthcare compliance and complex cloud environments across AWS, Azure, and GCP. His work spans the full audit lifecycle — assessing security procedures, reviewing configurations, interviewing control owners, and documenting results — including combined assessments across multiple compliance frameworks.
Emmanuel Amos-Abanyie
Head of Quality Assurance, InfoSec Solutions
As Head of Quality Assurance for InfoSec Solutions, Emmanuel leads the firm’s quality assurance program, driving consistency, technical excellence, and standardization across every audit engagement. He works closely with audit teams to strengthen audit methodologies, enhance reporting quality, and promote continuous improvement, helping clients receive accurate, rigorous, and reliable audit deliverables.
.avif)
