Case Study: Forage saves $100K on simultaneous SOC 2 and PCI audits with Thoropass
Key results
The challenge
After bringing cardholder data in-house, Forage needed PCI DSS Level 1 compliance while simultaneously meeting a contractual SOC 2 deadline by year-end, with a small team and a compressed timeline.
The solution
Forage ran SOC 2 and PCI audits together on Thoropass with a dedicated customer success manager, automated evidence collection across AWS, Rippling, and GitHub, and upfront expert guidance on both frameworks.
“If I had to gather every single piece of evidence for the SOC 2 audit manually, it would have delayed my PCI audit significantly.”
RGRob GormiskyInformation Security Lead, Forage
The results, in context
Forage reported over $100K in saved development costs and three to six months of development time saved, and beat its SOC 2 deadline by a month while meeting the full-scope PCI audit deadline. Asking auditors about PCI requirements upfront avoided building unnecessary engineering work.