Most SOC 2 platform searches do not start with a feature. They start when a company grows past something written on a plan page. We read the plan and pricing pages of eight platforms on 29 June 2026 and collected every limit they publish. This post lists them and explains what each one means for a team deciding whether to move.
Which limits are published?
| Vendor | Plan | Published limit | Source |
|---|---|---|---|
| Drata | Compliance Automation Foundation | Up to 50 FTEs | Source: Drata plans · read 2026-06-29 |
| Drata | Compliance Automation Foundation | 1 pre-mapped framework, limited to SOC 2, ISO 27001, Cyber Essentials, HIPAA or GDPR; more frameworks are add-ons | Source: Drata plans · read 2026-06-29 |
| Vanta | Essentials | One framework; Questionnaire Automation starts on Plus | Source: Vanta pricing · read 2026-06-29 |
| Vanta | Plus | Questionnaire Automation, 25 a year | Source: Vanta pricing · read 2026-06-29 |
| Vanta | Professional | 144 questionnaires a year | Source: Vanta pricing · read 2026-06-29 |
| Secureframe | Fundamentals | 1 compliance framework; Starting at $7,500/year | Source: Secureframe pricing · read 2026-06-29 |
| Sprinto | Foundation | AI security questionnaire automation, 20 a year | Source: Sprinto pricing · read 2026-06-29 |
| Scytale | Build Starter | Build Platform Plan, 1 framework, add-ons | Source: Scytale pricing · read 2026-06-29 |
Thoropass, Scrut and Comp AI publish no plan limits on the pages we read. Thoropass's pricing URL shows no prices, Scrut's pricing URL returned Page Not Found, and Comp AI says it presents its price on a 20-minute call.
What does a headcount cap mean for a switch?
Drata is the only vendor in our lineup that publishes a headcount limit on its entry plan. A company at 45 people that plans to hire past 50 within the year is effectively buying two plans: Foundation now and a GRC plan later. That is not a reason to leave Drata on its own, because moving up a tier keeps your evidence and integrations in place. It is a reason to ask for the price of the next tier before signing the first.
What does a one-framework entry plan mean?
Four vendors describe an entry plan or bundle with one framework: Drata Foundation, Vanta Essentials, Secureframe Fundamentals and Scytale Build Starter. The pattern is common because a first SOC 2 needs only SOC 2. The pressure comes with the second framework, often ISO 27001 for international customers or ISO 42001 for AI products.
When that happens, compare two numbers: the cost of the next tier with your current vendor, and the cost of a platform whose entry plan already covers both. Sprinto, for instance, lists 25+ frameworks automated on its Foundation plan. Because neither number is published by most vendors, both have to come from quotes.
What does a questionnaire allowance mean?
Questionnaire allowances matter to sales-led companies. Vanta publishes the clearest ladder: no Questionnaire Automation listed on Essentials, 25 a year on Plus and 144 a year on Professional. Sprinto lists 20 a year on Foundation. Secureframe puts questionnaire automation on Complete, a quoted plan, rather than Fundamentals. Scytale, Drata, Thoropass, Scrut and Comp AI publish no annual allowance.
If your team answers two or three questionnaires a week, a 20 or 25 a year allowance will run out early. Count last year's questionnaires before you compare plans.
Which limits are not published anywhere?
Contract length, renewal price increases, data export rights and migration help are not on any of the public plan pages we read. They are often the limits that decide how easy the next switch will be. Put them in your procurement questions.
How should you use this list?
- Find your current plan in the table and note which limit you will reach first.
- Ask your current vendor for the next tier's price and limits.
- Run the switch planner with your headcount and frameworks; it flags each published limit your answers hit.
- Compare the next tier against the top alternatives on the alternatives page for your platform.
A limit is a fact about a plan, not a verdict on a platform. The point of listing them is to make the next conversation with your vendor, or a new one, specific.