Choosing the auditor separately
Some boards and customers prefer the firm that attests to your controls to be chosen separately from the software that prepares them.
Comparison
An alternative to Thoropass
Thoropass is a licensed audit firm that sells the audit and the compliance software together. Noru is software only, so you keep the auditor of your choice. Here is how that and the rest compare, from Thoropass's own pages.
Why alternatives
What teams tell us they are re-evaluating
Common reasons teams evaluate other options.
DORA and the EU AI Act
Thoropass's frameworks page lists NIS2 but not DORA or the EU AI Act, which EU financial and AI teams now carry.
Where the data lives
Thoropass does not state a hosting region on the pages we reviewed. EU buyers and their DPIAs need that answer in writing.
Privacy kept as documents
A records-of-processing register maintained by hand drifts out of date the moment engineering ships.
Noru vs Thoropass: Key Differences
| Feature | Noru | Thoropass |
|---|---|---|
| What you buy | Software; you contract your own auditor | Licensed audit firm plus software, from one vendor |
| Published framework catalogue | 30+ frameworks, mapped once and reused | No total stated; SOC 2, ISO 27001, GDPR, NIS2, HIPAA and more |
| DORA and the EU AI Act | Supported | Not listed on its frameworks page |
| ISO 42001 | Supported | Supported, with audit |
| Pricing model | Platform plus capability packages, scoped per deployment | Not published; one quote covering software and audit |
| Data residency | EU data residency by default | Not stated |
| AI client access (MCP) | Model Context Protocol server for Claude, ChatGPT, Cursor and others | MCP server for audit data, announced July 2026 |
Your auditor, your choice
Noru prepares the evidence; any audit firm or certification body you choose attests to it. The software and the attestation stay separate contracts.
EU regulation in depth
NIS2, DORA, the Cyber Resilience Act and the EU AI Act alongside SOC 2 and ISO 27001, mapped through one control library.
EU residency by default
Every customer's evidence, policies and personal data are stored and processed in the EU. AI inference is the one activity that may leave the EEA, under EU Standard Contractual Clauses.
Privacy records from your code
Article 30 records and a data map derived from source code and CI, so the register changes when your systems do.
Why Noru
Where Noru is different
What sets Noru apart for faster, smarter compliance.
Moving from Thoropass
Evidence from your own systems is collected again once integrations are connected, and your policies, risks and vendor records come across. If your auditor came with the Thoropass contract, line up an audit firm before the switch — we can talk through what the evidence handover looks like.
Reconnect integrations; evidence is collected again from source
Bring across policies, risks and vendor records
Choose an audit firm before your next cycle
Time the switch around your next audit window
What is the best Thoropass alternative?
If you want the software and the audit on separate contracts, Noru is a Thoropass alternative: it prepares the evidence across 30+ frameworks, including DORA and the EU AI Act, and any audit firm you choose attests to it.
Does Noru include the audit like Thoropass does?
No. Thoropass is itself a licensed audit firm and sells the audit with its software. Noru is not an audit firm: you contract your auditor directly, and Noru's job is to have the evidence collected and mapped when they ask.
How much does Noru cost compared with Thoropass?
Neither publishes prices, and the quotes cover different things: Thoropass's reflects software and audit together. Noru licenses the platform plus the capability packages your obligations require, priced per deployment, with the audit contracted separately. Book a demo for a written quote.
Does Noru train AI on our compliance data?
No. Customer data is never used to train, fine-tune or evaluate any model — Noru's or a provider's — and every AI feature runs under zero data retention terms, so the model provider returns the output and keeps no copy of the prompt or response. Both commitments are contractual, in Section 4.6 of our Terms and Sections 3.5–3.6 of our DPA. Ask every vendor you shortlist for the same in writing.
Primary sources
Every claim about Thoropass on this page comes from the public pages below, last checked on . Competitor products and prices change — if something here is out of date, tell us and we will correct it.
See Noru against your own systems
A 45-minute walkthrough against your frameworks, your integrations and your evidence — and an honest answer on whether Noru is the right fit.