Rates.
Publicly.
A founder shouldn't have to sit through a sales call to find out whether they can afford to sell into enterprise. We publish our base rates openly. No "contact us for enterprise" button — we publish the band up to 300 employees and custom beyond that.
Fixed-fee commitment
The quoted price does not change unless you request a scope change in writing. No overruns, no surprise hourly billing for extra evidence review.
Frameworks
| Framework | Timeline | Starts at | |
|---|---|---|---|
| SOC 2 | Attestation report over Trust Services Criteria. | 4-6 weeks | $9,000 |
| ISO/IEC 42001 | Accredited certification for Artificial Intelligence Management. | 6-8 weeks | $16,500 |
| ISO/IEC 27001 | Accredited certification for Information Security Management. | 6-8 weeks | $14,500 |
| NIST AI RMF | Assessment and opinion letter on AI risk management. | 4 weeks | $12,000 |
| PCI DSS | ROC and SAQ validation for payment data environments. | 4-8 weeks | $15,000 |
SOC 2
| Scope (headcount) | Type I price | Type II price | Typical timeline |
|---|---|---|---|
| < 50 employees | $9,000 | $12,000 | 4 - 6 weeks |
| 50 - 150 employees | $11,500 | $15,500 | 5 - 7 weeks |
| 151 - 300 employees | $14,500 | $19,500 | 6 - 8 weeks |
| > 300 employees | Custom quote based on complexity | ||
Includes Security criterion. Additional Trust Services Criteria (Availability, Confidentiality, etc.) add $1,500 each.
Adding a Trust Services Criterion later mid-flight can add three to six months and $10K–$20K. Scope accurately upfront.
ISO/IEC 27001
ISO audit days derive from ISO/IEC 27006 tables based on in-scope headcount. The numbers below are calculations, not arbitrary list prices.
| Scope (headcount) | Initial cert (year 1) | Surveillance (year 2/3) | Audit days |
|---|---|---|---|
| < 50 employees | $14,500 | $8,500 / yr | ~ 12 days |
| 50 - 150 employees | $18,000 | $10,500 / yr | ~ 15 days |
| 151 - 300 employees | $22,500 | $13,000 / yr | ~ 19 days |
| > 300 employees | Custom quote based on complexity | ||
ISO/IEC 42001
| Scope (headcount) | Initial cert (year 1) | Surveillance (year 2/3) | Audit days |
|---|---|---|---|
| < 50 employees | $16,500 | $9,500 / yr | ~ 14 days |
| 50 - 150 employees | $21,000 | $12,000 / yr | ~ 17 days |
| 151 - 300 employees | $26,500 | $15,000 / yr | ~ 22 days |
Recurring costs
Every framework requires ongoing maintenance. Budget for this just as prominently as year one.
- SOC 2 Type II: Annual report generation. Typically priced similar to the initial Type II fee, minus onboarding.
- ISO 27001 & ISO 42001: 3-year certification cycle. Year 2 and Year 3 require surveillance audits (discounted, as shown above). Year 4 requires a full recertification audit.
Program Math
Running multiple frameworks in a single engagement reduces fieldwork and overlaps evidence collection. The saving is passed directly to the fixed fee.
DUAL TRACK (SOC 2 + ISO 27001)
AI ASSURANCE PROGRAM
What moves a quote?
The base rates cover a single product line, single cloud environment, and standard control maturity. We adjust up if the environment is complex, because it takes more days to test.
- Multi-region or multi-cloud infrastructure
- Multiple distinct product lines under scope
- Highly decentralised engineering teams
- Incomplete readiness demanding extended testing
We'd rather you budget correctly than sign quickly.
Get an exact
figure.
Fill out a short questionnaire with your company size and framework needs. We return a binding fixed-fee proposal within one business day.
Request a quote ↗