Get SOC 2 compliant. Examined by an independent CPA firm.

Sign up and answer the intake. There is nothing to pay and no card to enter. When you submit it you get a readiness score out of 100, the tier that score lands in, how many of the controls scored are already passing, every gap category with exact counts of what needs remediating and what needs evidence, and two or three of your own findings written out in full with what closing each one takes. It also tells you exactly how many findings are in the rest of your report. The score lives in your account and recomputes whenever you change an answer. What it is not is a document you can download and take elsewhere: the full written gap list and the remediation tooling come with an entry payment, and you can ask for a readiness review from your results page, where you name the times that suit you and a member of the team confirms one within a business day.

Star is $2,000 one time. Orbit is $7,800 a year and Constellation is $10,800 a year, each with your SOC 2 Type 2 audit included every year. The assessment is free.

The whole 12 months, on both sides. You are committing to the full term rather than to a month at a time, and across it we are committing to keep you audit-ready: evidence collection from your connectors, guided monthly check-ins that flag a control that stopped holding, deviation tracking, and that year's SOC 2 Type 2 audit, which starts on its own once the 3-month observation window completes and carries no separate auditor invoice. Orbit and Constellation are billed yearly. If you came through Star you can pay for Orbit monthly instead, and the commitment is the same 12 months either way. The exact terms are in the Terms of Service, and you accept them in writing before the first charge.

Type 1 proves your controls are designed correctly at a single point in time. You can get one starting at about a week, and enterprise buyers usually accept it to unlock a deal. Type 2 proves your controls actually worked over an observation period. Polara Labs locks your first Type 2 observation at 3 months, the minimum first-year window under SOC 2, so customers reach their first Type 2 audit on a predictable schedule. The subscription runs continuously during and after that window on a 12-month term, and the audit at the end of the first window is inside it.

When you choose. Step 1 has no clock: work through your gaps and policies at your own pace. Once your package is built you start SOC 2 Type 2 from your dashboard whenever you are ready, and the 12-month term and the 3-month observation window begin that day. Your first Type 2 audit starts on its own when the observation window closes, and it is included in the term.

Yes. A SOC 2 Type 1 report is $2,000 more on top of Star, at checkout or later from your dashboard. Your package goes to an independent licensed U.S. CPA firm as soon as it is built, and once the Type 1 report is issued you can move to Orbit whenever you are ready.

Type 1 goes audit-ready starting at about a week of focused work. Intake takes about 15 minutes for the half that returns your score, and the rest can wait. Evidence upload and remediation depend on how prepared you are, but the platform tells you exactly what is needed and tracks progress live. Once you hit 100 percent, auditor review typically takes a few business days. Type 2 then runs on top, quietly, through its observation window.

They are independent partner auditors, licensed U.S. CPA firms. Polara Labs is not a CPA firm and does not issue the opinion. The specific firm on your engagement is disclosed to you on request before you sign the engagement letter, so you can verify their credentials with the state board. If you already work with a CPA firm that meets AICPA independence requirements, we can onboard them.

The industry had a recent high profile scandal where a venture backed compliance platform was caught producing hundreds of SOC 2 reports with identical boilerplate and pre written auditor conclusions. We built the opposite. Our gap analysis is a deterministic rules engine, not AI. Policies are generated from your data and fail loudly rather than fabricating claims. Examinations are performed by independent partner auditors with no referral fees. Every report is unique because every company is different. See the ethics section above for the full architecture.

AI drafting runs on Anthropic Claude models hosted on Amazon Bedrock inside our own AWS account, in the United States. Our commercial agreement with AWS forbids training on your data, Bedrock does not store prompts or outputs, and only the minimum data each task needs is sent. Evidence files stay encrypted in our own AWS storage, reachable only by you and your assigned auditor through short-lived links. Each company is isolated.