Browser automations capture evidence from tools without an integration
Open-source compliance platform that uses AI agents to prepare companies for SOC 2, ISO 27001, HIPAA and GDPR audits
Prices in US dollars as Comp AI's pricing page showed them on 11 October 2026.
Comp AI is an open-source compliance platform that uses AI agents to get companies ready for SOC 2, ISO 27001, HIPAA and GDPR audits, collecting evidence, writing policies and running a trust centre. It suits startups and growing software firms that need a security certificate to win enterprise deals. There is no public price list: each quote is given on a 20-minute call, with a 12-month minimum term. The code can also be self-hosted free.
Integrations with cloud, code and HR tools pull evidence on a schedule and auto-complete matching tasks. Custom automations can be written in plain English, such as checking that Dependabot is switched on.
An AI-driven browser signs in to tools with no API, including ones behind two-factor sign-in, and captures screenshots stamped with the requirement, source and time. Runs can be watched live and taken over by a person.
Policies are generated from onboarding answers about the company's stack and processes rather than a fixed template. An AI policy editor proposes changes as a tracked diff that can be applied or dismissed.
An open-source desktop agent for macOS, Windows and Linux checks disk encryption, antivirus, password length and screen lock every hour and reports failures to the Comp AI portal.
Read-only connections to AWS, Azure and Google Cloud run continuous security checks. On AWS, an optional second role lets a person apply a fix from Comp AI; nothing changes on a schedule.
A public trust portal shows only published policies and passing controls. Prospects can request access to documents, sign an NDA and receive a time-limited grant, with an audit trail for every step.
Uploaded questionnaires are answered from published policies and a knowledge base, and a Chrome extension drafts answers on vendor portals and in Google Sheets. Unsupported questions are flagged for review rather than guessed.
AI-assisted penetration tests run against a target URL and produce Markdown or PDF reports. A hosted MCP connector lets Claude, ChatGPT, Cursor and VS Code work with the compliance programme.
Works with
Contact sales
Quote given on a 20-minute call; 12-month minimum term
No public price list. Fees are in US dollars and exclude taxes, with a 12-month minimum commitment and annual auto-renewal (30 days' notice). The open-source code can be self-hosted without a licence fee. Prices in US dollars, from Comp AI's pricing page on 11 October 2026. Comp AI may charge VAT on top, and prices can change.
“Had considered using the platform, but after some research and discovering they use dodgy practices”
Comp AI is a compliance automation platform for software companies that need a SOC 2 report or an ISO 27001 certificate, usually because a large customer has asked for one. It prepares the company for the audit; an independent auditor still carries out the audit and writes the report.
After onboarding questions about the business and its tools, Comp AI drafts the policies, maps them to controls and connects to systems such as AWS, Azure, Google Cloud, GitHub and Google Workspace to collect evidence automatically. A desktop agent checks that staff laptops have disk encryption, antivirus, a password policy and screen lock. Browser automations can sign in to tools that have no integration and capture dated screenshots as evidence. Comp AI says customers become ready for a SOC 2 Type I audit in about 10 days on average, depending on how much is already in place.
Comp AI doesn't publish prices. Each quote depends on the frameworks in scope, headcount, the deadline and whether the audit, a penetration test and the trust centre are included, and it is given on a 20-minute call.
The terms of service state that fees are in US dollars, exclude taxes, and carry a minimum 12-month commitment whether billing is monthly, quarterly or annual. Subscriptions renew for another year unless notice is given at least 30 days before the end of the term. For UK buyers, that means a dollar invoice and a sterling cost that moves with the exchange rate; the pricing page doesn't mention VAT or pound prices. Comp AI's own SOC 2 cost guide says the audit, penetration test, extra frameworks, user seats and setup are included in its pricing, which is worth confirming line by line in any quote.
Comp AI is the younger and more open option; Vanta and Drata are larger, longer-established platforms with far more reviews and auditor familiarity.
Comp AI's differences are its open-source code (AGPLv3, on GitHub), the option to self-host, bundled audits and penetration tests, and support through a shared Slack channel. On the other side, Vanta and Drata are longer established, and independent reviewers advise checking that a chosen auditor is happy to work from Comp AI before signing. Secureframe and Sprinto are other established alternatives.
Comp AI states that data is encrypted at rest with AES-256 and in transit with TLS, and that integration credentials are encrypted again before storage. Its own trust centre lists SOC 2, ISO 27001 and GDPR status.
Its published sub-processors (AWS, Vercel, Stripe, Anthropic and OpenAI) are all listed in the United States, and no UK or EU hosting option is mentioned, which matters for UK GDPR transfer checks. Comp AI says its AI providers may not train on customer data. Cloud connections are read-only by default: AWS changes need a separate role and a person pressing Fix. Because the code is public, a security team can read exactly what the agents and integrations do.
The core platform is open source and can be run on your own servers with Docker, so there is no licence fee for that route. A small enterprise part of the code sits under a commercial licence.
Self-hosting needs an external PostgreSQL database, a Resend account for email and a Trigger.dev account for background jobs, plus someone to handle updates, backups and uptime. It also doesn't include the auditor, penetration tests or the expert support that come with the paid service.
The main lever is scope: a quote for one framework costs less than several, and Comp AI says adding ISO 27001 to an existing SOC 2 programme starts about two-thirds done because controls overlap.
No student, non-profit or startup discount is published, and no free trial is listed on the pricing page.
Free planAI code reviews on pull requests, in the editor and in the terminal, for GitHub, GitLab, Bitbucket and Azure DevOps
AI agents that test web, iOS and Android apps from plain-English steps and report pass or fail with video and screenshots
We don't currently list a confirmed discount code. That doesn't mean the store has no promotions; check its website for current prices.
Comp AI says audit costs can be bundled into its subscription, and its pricing page lists the audit as one of the things that changes a quote. The audit itself is carried out by an independent accredited auditor, who writes and uploads the report.
Yes. Comp AI describes itself as auditor-agnostic: any accredited auditor can be given access to the organised evidence, controls and policies.
The terms of service set a minimum 12-month commitment and say fees are non-refundable except as the agreement states. Subscriptions renew for a year unless either side gives written notice at least 30 days before the term ends.
The device agent runs on macOS 14 or later, Windows 10 or later and Ubuntu 20.04 or later. It checks disk encryption, antivirus, password length and screen lock every hour, and Comp AI says it doesn't collect browsing history or file contents.
Yes. Questionnaires uploaded as PDF, Word or spreadsheet files are answered from the company's published policies, and a Chrome extension drafts answers directly on vendor portals, web forms and Google Sheets. Every answer can be edited before it is used.
The pricing page lists SOC 2, ISO 27001, HIPAA, GDPR, PCI DSS, SOC 1, NIST, ISO 42001, ISO 9001, CCPA, NEN 7510 and FedRAMP, among others.
