Thoropass

I value the dedicated customer success manager who works with us throughout the process. Thoropass keeps us on schedule with reminders for recurring tasks and efficiently tracks policy and security training. I'm pleased with the product and new features like access review that enhance our experience. Setup was simple, and we got everything ready for SOC 2 Type 1 and moved straight into the Type 2 monitoring period. We had no pain points. It helps with policy control, evidence collection, and pen test engagement, and keeps us on track with reminders for recurring tasks and training.

I've used Thoropass for SOC 2 twice—once at a previous company and now at my current—and both times were excellent. The platform is user-friendly, well-organized, and clearly shows what's needed, in progress, or audit-ready. Implementation is easy even for organizations with varying security maturity. Customer support stands out with responsive, knowledgeable staff who convert requirements into actionable steps. Feature-wise, it covers everything needed for SOC 2 in one place: control management, evidence tracking, policies, vendor risk, and audit coordination. It makes SOC 2 far more manageable and repeatable, and I'd highly recommend it. There's very little to dislike; advanced features might take a bit to explore but the learning curve is minor. It centralizes controls, evidence, policies, and workflows, eliminating spreadsheets and manual tracking, saving time, reducing stress, and making SOC 2 scalable across organizations.

I use Thoropass to manage SOC 1, SOC 2, and GDPR internally, and they conduct our annual SOC 1 Type 2 and SOC 2 Type 2 audits. Their tooling greatly streamlines our security and compliance, with much better reporting and automated data collection. Assigning and delegating tasks in one place is very useful. The platform is highly usable and easy to navigate; I onboarded quickly as compliance lead. Audit evidence requests were simpler, and it pulls data from other tools for automated collection. Initial setup was easy and helped understand SOC requirements. I've encountered some issues with user access and people management, and custom integrations would be great. Their questionnaire tool is limited, but overall it's valuable for streamlining efforts, improving reporting, and simplifying evidence collection.

I appreciated that while pursuing SOC 2 Type 1, the project manager met with me every two weeks, providing necessary inputs that kept me on track and made the process efficient. This helped me accelerate as much as possible, which was the best aspect. The setup was straightforward, though initially uploading evidence was unclear; after a couple of sessions with the manager, it improved. I use Thoropass for SOC 2 Type 1, and the regular meetings with the manager saved time and boosted efficiency.

1. It's a comprehensive, trusted all-in-one solution offering thorough audits, certified badges in reports, a legally binding audit certification (a huge bonus, as no separate accounting firm is needed), and ongoing support. 2. Professional account managers oversee the process from start to finish, checking in regularly to keep everyone on schedule and meeting deadlines. 3. The audit team appears available almost around the clock, answering questions promptly and wisely, providing excellent tips for using the platform, navigating the straightforward implementation, and handling complex integrations. 4. The UI/UX is great, making it intuitive for senior managers like me to ensure tasks are completed correctly and on time by my team, and to monitor support tickets. 5. Pricing is fair given what you get, and we negotiated a multi-year deal that we're satisfied with compared to what others pay. Drawbacks: not the cheapest option, AI suggestions can be off, duplicate document uploads are annoying (though AI improvements are emerging), and some navigation menus could be simpler. Overall, it builds trust with clients' security and compliance teams, simplifies achieving SOC 2, ISO 27001, and HIPAA, saves hundreds of hours per quarter on RFPs, and accelerates certifications by 50-75%.

So far, it's been an excellent tool for tracking every requirement on our compliance roadmap and taking charge of those processes. One suggestion—not a complaint—is that it could be even more helpful if alerts integrated natively with Slack and Asana, allowing closer monitoring beyond just email and console notifications. Our compliance scope is expanding, and staying compliant with all regulations is crucial in today's dynamic environment, so we must keep up with certifications as we grow. Thoropass has been a strong partner in achieving this; the ease of use, straightforward roadmaps, and comprehensive support are making our lives much easier.

The standout features are the user interface and navigation. Uploading documents and communicating with the CSM and auditors is effortless. During our compliance efforts, we logged in frequently and encountered no problems. Customer support was quick, and our questions were resolved immediately. The integration module was so intuitive even non-technical staff could connect various service providers to Thoropass without assistance. Implementing different compliance modules and uploading supporting documents is extremely easy and convenient. We've been using it for about three years now and haven't faced any issues. It's mainly helped us achieve the compliance certifications our organization needs. Additionally, the integrations help us address any problems with our CSP. It sends alerts whenever there's an issue with our CSP or if configurations aren't set correctly. Instead of checking multiple instances or servers, we can monitor everything from one place.

Thoropass simplified the SOC 2 process, making it easy, clear, and user-friendly. What could have been a time-consuming and research-heavy endeavor was made straightforward, guiding us exactly on what we needed to achieve SOC 2 Type 2 compliance. Their customer support was outstanding—they answered every query promptly, walked us through each phase with excellent communication and tracking, and provided helpful educational materials. With their support and online portal, handling evidence collection and interacting with our auditor was stress-free. Their portal, integrations, and templates also cut down the time needed for drafting policies, gathering evidence, and tracking controls. Overall, we were extremely satisfied with our choice of Thoropass. I can't point out any major drawbacks. As a small company new to SOC 2, we required a straightforward, low-stress engagement at a reasonable price that suited our limited resources. Thoropass delivered exactly that. We're now confident in handling future audits with their assistance and thrilled to offer secure solutions to our customers.

Thoropass effectively consolidates all our tasks, policies, and procedures in one location and sends timely notifications for required actions. It's beneficial that the whole team can participate in creating and updating policies, which keeps us aligned with security controls and strengthens our tech infrastructure. The initial setup was fairly simple, though it needed some time to tailor to our company's specifics. We encountered a few glitches with overlapping menu information, but they were resolved promptly. A suggestion would be to streamline the UX for performing tasks, making actions easier to tackle. Thoropass addresses keeping security controls current and offers a framework for audits. It centralizes tasks and policies, cuts down on manual effort, and ensures we stay on track, improving our tech security.

Initially, I felt daunted by the prospect of our first SOC2 audit since I'd never tackled such a task before. However, Thoropass reassured me right away that they'd support us at every stage, and they truly did! The following year, we got a new representative named Jade. She was exceptionally helpful, amiable, professional, and always available from the start. Jade aided us with training and compliance, becoming a crucial asset to our organization. Our regular meetings are informative, and we often walk away with new insights or warnings about potential oversights. Any question we have is just an email away and gets answered promptly. I'm grateful for everything Jade has done and continues to do for us. We receive email alerts to log in and complete tasks roughly monthly, and those reminders are valuable. The integration with our controls is practical, and the whole setup was manageable. The initial year was tough because we were unsure what to expect, but without Thoropass, we wouldn't be able to achieve our SOC2 certification. There's nothing I dislike about it. The platform is well-organized, and the task management is excellent. Once you get the hang of it, it's straightforward. We're now able to share annual SOC2 certification reports with our clients and partners, ensuring we stay compliant and secure.