Noru fits when
You want to choose your audit firm separately from your software, and your obligations include DORA, the EU AI Act or GDPR records of processing — with EU data residency in writing.
Comparison
Noru vs Thoropass: platform comparison
Thoropass is profiled from its own public pages, then compared with Noru where both can be evidenced. Unsourceable claims are left out.
What Thoropass says it does
Thoropass describes itself as a licensed auditor that delivers audits supported by purpose-built software, so a customer reaches infosec compliance with a single vendor. Its audit arm, Thoropass Assurance, is a licensed CPA firm, and it says the auditor is part of the team from scoping through attestation.
Its frameworks page gives no total but lists SOC 2, SOC 1, ISO 27001, GDPR, NIS2, HIPAA, HITRUST, PCI DSS, NIST CSF 2.0, CMMC and Cyber Essentials among others, with a separate ISO 42001 page. We found no Thoropass page covering DORA or the EU AI Act.
Pricing is not published. Thoropass gives each customer a quote reflecting both software and audit, scaled by frameworks, audit scope, company size and services. It names AI features for audit work and announced an MCP server in July 2026. We found no hosting-region statement on its pages.
Decision
Which one fits
A quick way to evaluate which platform matches your compliance goals.
Thoropass fits when
You want one vendor and one contract for the software and the audit, with the auditor involved from scoping onwards, and your frameworks are on Thoropass's list.
Compared on what we can evidence
| Feature | Noru | Thoropass |
|---|---|---|
| What you buy | Software; you contract your own auditor | Licensed audit firm plus software, from one vendor |
| Published framework catalogue | 30+ frameworks, mapped once and reused | No total stated; SOC 2, ISO 27001, GDPR, NIS2, HIPAA and more |
| DORA and the EU AI Act | Supported | Not listed on its frameworks page |
| ISO 42001 | Supported | Supported, with audit |
| Pricing model | Platform plus capability packages, scoped per deployment | Not published; one quote covering software and audit |
| Data residency | EU data residency by default | Not stated |
| AI client access (MCP) | Model Context Protocol server for Claude, ChatGPT, Cursor and others | MCP server for audit data, announced July 2026 |
Where Noru is differentiated
Software only: the audit firm or certification body is yours to choose
EU regulatory depth — NIS2, DORA, the Cyber Resilience Act and the EU AI Act — on one control library
EU data residency for every customer
Privacy records of processing derived from source code and CI
Where Thoropass is strong
Software and audit from one vendor, under one quote
A licensed CPA firm in-house, involved from scoping to attestation
Specialised US regimes including SOC 1, HITRUST and CMMC
AI built for audit work, and an MCP server for audit data
How we compared
Every statement about Thoropass is taken from Thoropass's own public pages, listed under Primary sources below.
Where Thoropass does not state a position publicly, the cell says so rather than inferring one.
Capability claims about Noru are our own and are not attributed to Thoropass.
Claims were last checked on 2026-10-17. If something here is out of date, tell us and we will correct it.
How much does Thoropass cost compared with Noru?
Neither publishes prices, and the quotes cover different scopes: Thoropass's reflects software and audit together. Noru licenses the platform plus the capability packages your obligations require, priced per deployment, with a written quote after a demo; the audit firm's fee is a separate contract.
Is it a problem that Thoropass audits what its own software prepares?
That is a judgement for you, your board and your customers. Thoropass presents the integrated model as a benefit — one team from scoping to attestation. Some buyers prefer the attesting firm to be chosen separately from the software vendor; Noru supports that model.
Does Thoropass support DORA or the EU AI Act?
We found neither on Thoropass's frameworks page or elsewhere on its site at the time of review. It lists NIS2 and GDPR, and has an ISO 42001 page. Noru supports DORA, the EU AI Act and ISO 42001.
Can we migrate from Thoropass to Noru?
Yes. Evidence is collected from your own systems, so migration is largely reconnecting integrations, bringing across policies and registers, and re-mapping controls. If your auditor came with Thoropass, choose an audit firm before your next cycle.
Do you train AI models on our compliance data?
No. Customer data is never used to train, fine-tune or evaluate any model — Noru's or a provider's — and every AI feature runs under zero data retention terms, so the model provider returns the output and keeps no copy of the prompt or response. Both commitments are contractual, in Section 4.6 of our Terms and Sections 3.5–3.6 of our DPA. Ask every vendor you shortlist for the same in writing.
Primary sources
Every claim about Thoropass on this page comes from the public pages below, last checked on . Competitor products and prices change — if something here is out of date, tell us and we will correct it.
See Noru against your own systems
A 45-minute walkthrough against your frameworks, your integrations and your evidence — and an honest answer on whether Noru is the right fit.