Is there a SOC 2 platform that includes the audit itself?

Yes. Chiaro puts SOC 2 readiness software and the audit itself in one product, run inside the AI tool you already use, like Claude Code, Codex or Cursor.

Chiaro is a product of Y Assurance PLLC, a certified public accounting firm licensed by the Texas State Board of Public Accountancy and authorized to perform SOC 2 Type I and Type II examinations under AICPA attestation standards. That firm performs your audit and signs your report.

Chiaro is our company. I'll cover how it works, what it costs, and the questions I'd ask about any platform that sells you the audit, ours included.

A licensed CPA firm signs every SOC 2 report, bundled or not

A SOC 2 report is a CPA firm's opinion on your controls, meaning the safeguards you use to protect customer data. It's issued under the AICPA's attestation standards. The AICPA is the professional body for CPAs in the US, and its attestation standards are the rules a CPA follows when giving an opinion other people rely on. AT-C 205, the one that governs the examination, puts responsibility for that opinion on the auditor alone. Software can collect and organize evidence. Signing the report stays with the CPA firm.

So any platform that includes the audit has a CPA firm doing that part. What differs is how the two are connected.

Compliance platforms like Vanta, Drata, Secureframe and Sprinto are software companies. They organize evidence and track controls, and that work is genuinely useful. The audit is a separate engagement with a licensed CPA firm, and that firm signs the report. Plenty of companies get a solid audit that way.

Chiaro runs in the other direction. The product comes from the firm that performs the audit, so the readiness software, the examination and the report all come from one firm.

Chiaro covers readiness, the audit and a Trust Center

• Readiness. Your AI connects to Chiaro through MCP, the standard way AI tools connect to outside services. Chiaro looks at how you run things today, tells you in plain terms where the gaps are, and walks you through fixing them until you're ready for the audit. You make the calls. We tell you what good looks like.
• The audit. A Type I confirms your controls are designed and in place on one date. A Type II tests how they operated over a period of three, six or twelve months. The evidence is collected through your own AI, and the firm examines it and signs the report.
• A Trust Center. The public trust page we publish for you to present your report, free with any audit.

You don't need a separate compliance platform or evidence collection tool alongside it. If you'd rather use a different auditor, you can take your readiness work with you. And if your controls are already in place, you can skip readiness and buy the audit on its own.

Our prices are published up front

I think everyone deserves to see the price before they talk to anybody. It saves time on both sides, and it's the honest way to start. So everything is on our pricing page, including readiness, the Type I and Type II audit and every add-on, with the exact total shown before you buy.

Our prices are low because AI handles the prep work that never needed a person, while a licensed auditor still makes every judgment call in your audit. Readiness is a one-time fee that starts with 30 days free, and if you cancel before then you're never charged. Every audit after your first is 20% off. Nothing is a subscription, and nothing renews.

You make every decision, and the firm examines what you built

Here's how the work splits. During readiness, we tell you what's missing and what good looks like. You decide how to close each gap, and you build it. At the audit, we collect the evidence fresh and examine what you built. You own your controls, and that's written into the engagement letter, where your security team can read it.

The AICPA's rules for this sit in ET 1.295, which covers the other work an audit firm does for a company it audits, readiness included. I wrote up where that line sits and how to check any firm against it.

Five questions show what a bundle really includes

I'd ask these about any platform that sells you the audit, and I'd want the answers in writing.

1. Which CPA firm signs the report? Get its legal name and home state, then look up its registration with that state's board of accountancy. Enrollment in the AICPA Peer Review Program is public too, at peerreview.aicpa.org.
2. What does the price cover? Readiness, the audit and the report should each be named, along with anything that renews.
3. Who sets the audit fee and the deadline? In April 2026 the AICPA's ethics staff wrote about audit firms that work with compliance tool providers. They flagged audit fees a third party controls or ties to other services, referral payments that may need to be disclosed to you in writing, and deadlines a tool provider sets without regard to the auditor's judgment.
4. Does the auditor check the evidence itself? In May 2026 the AICPA warned that some SOC firms lean too heavily on third-party platforms without applying the professional judgment the work requires. The auditor still has to check where the evidence came from and whether it's complete.
5. Can you see how they test? Ours is published on GitHub: what we test, what counts as evidence, and what passes.

Ask us the same five.