Comp AI: an open-source Vanta rival with $6.7M verified revenue
Three founders from a shut-down AI startup built open-source SOC 2 software in 2025. TrustMRR shows $6.7M all-time revenue; a $34M Series A came in 2026.
- Product
- Comp AI
- Founder
- Lewis Carhart, Claudio Fuentes and Mariano Fuentes
- Launched
- 2025-01
- Model
- B2B subscription with a free self-hosted edition
Published · 2 min read · 5 sources
- #compliance
- #soc2
- #open-source
- #b2b-saas
- #ai-agents
- #security
- #trustmrr
Key takeaways
- The founders previously ran LeapAI, which passed a million users but shut down; doing SOC 2 by hand there gave them the idea.
- Comp AI publishes a free AGPLv3 Community Edition on GitHub and sells a separate cloud product against Vanta and Drata.
- TrustMRR (Stripe-verified, checked 5 Nov 2026): $6,699,738 all-time revenue and $883,710 in the last 30 days; the company says it has more than 1,000 customers.
What it is
Comp AI automates compliance work for frameworks like SOC 2, ISO 27001, HIPAA and GDPR: evidence collection, policy generation and continuous monitoring (TrustMRR). Its GitHub repo calls it an "AI Native platform to get companies compliant - Vanta & Drata Alternative"; the Community Edition there is free and AGPLv3-licensed, while Comp AI Cloud is a separate commercial product (GitHub).
Timeline
- Before 2025: the three founders work together at LeapAI, a workflow platform that grew to "more than a million users" before they shut it down for lack of a "sticky enough use case" (TechCrunch).
- Jan 2025: Comp AI is founded (TrustMRR, Comp AI).
- 2025: a $2.6M pre-seed co-led by Grand Ventures and OSS Capital (Grand Ventures).
- 17 Sep 2026: a $34 million Series A led by Roo Capital and Grand Ventures, with $37.5 million raised in total (TechCrunch). The company says it has more than 1,000 customers and 15x year-over-year ARR growth (Comp AI).
- 5 Nov 2026: TrustMRR shows $6,699,738 all-time revenue and $883,710 in the last 30 days, verified with Stripe (TrustMRR).
Why it worked
- The founders had the pain. At LeapAI, SOC 2 "took us a couple of months of doing things by hand, and the whole time it meant taking our eyes off building the product," Claudio Fuentes said (TechCrunch).
- Compliance is tied to revenue. "For a lot of software companies, security and compliance are directly tied to revenue," Carhart said, since buyers ask for a SOC 2 report before closing (TechCrunch).
- Open source as distribution. The free self-hosted edition is a credible alternative to expensive incumbents and a way to earn developer trust (GitHub). Its investor said it saw "solo founders and two-person teams" reaching SOC 2 with it (Grand Ventures).
- A lesson from the last startup. The team said LeapAI taught them "the importance of finding a specific use case" (TechCrunch).
What to learn
- A failed startup can hand you the next idea: list the boring work it forced you to do.
- Pick a problem with a deadline and a budget attached. A blocked enterprise deal is a strong reason to pay.
- Open-sourcing the core can work against well-funded incumbents if the paid hosted version saves real time.
Risks and what didn't work
- Lumpy revenue. TrustMRR shows only $16,308 MRR from 58 active subscriptions next to $883,710 in 30-day revenue (TrustMRR), which suggests much of the money comes from larger or one-off payments rather than monthly plans.
- AI does not replace the auditor. The software "doesn't replace actual independent audit review," and people still review what agents draft (TechCrunch).
- Crowded market with well-funded players like Vanta and Drata (TechCrunch).
- Customer counts and growth rates are company-reported; revenue figures are Stripe-verified on TrustMRR.
FAQ
Short answers drawn from the sections above.
What is Comp AI?
Comp AI automates compliance work for frameworks like SOC 2, ISO 27001, HIPAA and GDPR: evidence collection, policy generation and continuous monitoring (TrustMRR). Its GitHub repo calls it an "AI Native platform to get companies compliant - Vanta & Drata Alternative"; the Community Edition there is free and AGPLv3-licensed, while Comp AI Cloud is a separate commercial product (GitHub).
Why did Comp AI work?
- The founders had the pain. At LeapAI, SOC 2 "took us a couple of months of doing things by hand, and the whole time it meant taking our eyes off building the product," Claudio Fuentes said (TechCrunch).
- Compliance is tied to revenue. "For a lot of software companies, security and compliance are directly tied to revenue," Carhart said, since buyers ask for a SOC 2 report before closing (TechCrunch).
- Open source as distribution. The free self-hosted edition is a credible alternative to expensive incumbents and a way to earn developer trust (GitHub). Its investor said it saw "solo founders and two-person teams" reaching SOC 2 with it (Grand Ventures).
- A lesson from the last startup. The team said LeapAI taught them "the importance of finding a specific use case" (TechCrunch).
What can indie builders learn from Comp AI?
- A failed startup can hand you the next idea: list the boring work it forced you to do.
- Pick a problem with a deadline and a budget attached. A blocked enterprise deal is a strong reason to pay.
- Open-sourcing the core can work against well-funded incumbents if the paid hosted version saves real time.
What didn't work for Comp AI, and what are the risks?
- Lumpy revenue. TrustMRR shows only $16,308 MRR from 58 active subscriptions next to $883,710 in 30-day revenue (TrustMRR), which suggests much of the money comes from larger or one-off payments rather than monthly plans.
- AI does not replace the auditor. The software "doesn't replace actual independent audit review," and people still review what agents draft (TechCrunch).
- Crowded market with well-funded players like Vanta and Drata (TechCrunch).
- Customer counts and growth rates are company-reported; revenue figures are Stripe-verified on TrustMRR.
Sources
Every link cited above, in order of first use.
- 1.TrustMRR (trustmrr.com)
- 2.GitHub (github.com)
- 3.TechCrunch (techcrunch.com)
- 4.Comp AI (trycomp.ai)
- 5.Grand Ventures (grandvcp.com)
Related case studies
More in AI tools →Screenshot to Code: an 81K-star GitHub repo that became a $263K bootstrapped app, now for sale
Abi Raja's open-source screenshot-to-code tool turned GitHub stars into a hosted product with Stripe-verified revenue. Now he has a new job and has listed it for a quick sale. Here is what the numbers on TrustMRR and GitHub show.
Cometly: two agency founders turned an ad-tracking spreadsheet into $10M verified revenue
Grant Cooper and Matt Pattoli ran an ad agency, saw ad platforms mis-attribute sales, and built Cometly to fix it. TrustMRR's Stripe data shows over $10M in all-time revenue from a few hundred B2B subscriptions.
Rezi: a Reddit resume template that became an AI resume builder with verified $240K MRR
Jacob Jacquet posted an ATS-friendly resume on Reddit in 2015, built Rezi in Seoul while teaching English, and plugged in GPT-3 weeks after OpenAI let him in. Stripe-verified revenue on TrustMRR shows where early AI adoption led.