What it does
Comp AI sells one thing the rest of the SOC 2 platform market does not: a compliance automation stack where the agent code, the integration catalog, and the controls library are open source on GitHub under AGPLv3. The hosted platform at trycomp.ai owns the dashboard, evidence storage, AI policy generation, and the auditor handoff. The agents that collect evidence on the customer side are the part you can read, fork, and self-host. That split is the entire pitch, and it is the only credible open-source play against Vanta, Drata, and Secureframe as of May 2026.
What you get
Five frameworks covered on the homepage: SOC 2, ISO 27001, HIPAA, GDPR, and FedRAMP (trycomp.ai). 580+ integrations for evidence collection. AI-generated policies tied to the framework you select. A customer-facing trust center for sales enablement. Penetration testing bundled into the platform tier rather than billed as a separate service. A 1:1 Slack channel with the Comp AI team listed as a standard support offering. The repo is at github.com/trycompai/comp, 1.6k stars as of mid-May 2026, AGPLv3 license, with a small commercial "/ee" enterprise-edition carve-out the README discloses up front.
Who should use it
Founders and heads-of-ops at 5- to 50-person SaaS teams chasing SOC 2 Type I or Type II to clear mid-market deals. The bar to qualify is real: you need a person on the team who can read a package.json, run a Docker container, and reason about what an evidence-collection agent does. If that person does not exist, the open-source story is dead weight and Drata is the easier buy. Secondary fit: compliance consultants and fractional CISOs who need a non-locked-in platform they can carry across clients without dragging a per-seat Vanta bill along.
Pricing
Not published on the marketing site as of 2026-05-19. The pricing page on trycomp.ai routes to "talk to sales" the same way Vanta and Drata gate theirs. The self-host route is genuinely free of license fees under AGPLv3, but it carries real DevOps cost the moment your auditor wants evidence that the agents are operating continuously and pulling clean snapshots.
Verdict
Buy the hosted Comp AI when you want the platform features of Vanta or Drata, plus the trust posture of being able to point a security-conscious buyer at the GitHub repo and say "this is the code that collects our evidence." Self-host when you have the DevOps depth to operate it and your buyer specifically asks where their data sits. Rated 4.2: the platform is newer than its competitors and the auditor network around it is still ramping, but the open-source posture is the genuine differentiator in a market where Vanta, Drata, and Secureframe have converged on the same checklist.