Menu
On this page
Iru combines device management with SOC 2 compliance automation. Its Endpoint product can enforce supported policies and send device state to Compliance Automation. If you use an MDM alongside Vanta or Drata, Iru could replace both tools. Ask Iru to trace a failed device setting through remediation and into evidence your CPA can inspect, then quote the products and device counts you need. Keeping your MDM reduces the benefit of switching. Iru has no documented vendor-risk workflow, and Compliance Automation has a shorter public record than Vanta or Drata.
Compare with: our Vanta review or our Drata review for a longer compliance-specific track record; our Secureframe review when guided implementation matters more than device management.
Pros
- Native endpoint evidence
- Control-linked artifacts and auditor roles
- Human-approved Adaptive Compliance changes
Cons
- Newer Compliance Automation product
- No advertised vendor-risk workflow
- Windows control depth needs proof
- Other product and seat mixes require quotes
Iru is Kandji after the company’s October 22, 2025 rebrand. Kandji’s endpoint product continues under Iru, while Compliance Automation was introduced as part of the broader platform expansion. The buying mistake is to treat a strong Apple-device-management review as proof that the newer SOC 2 workflow will collect the right evidence, recover from a broken source, and give your CPA what it needs. The Iru software profile maintains the dated capability and source record. For how Iru compares with other platforms, see our SOC 2 software guide.
Where does Iru’s SOC 2 evidence come from?
Iru says Compliance Automation can use native endpoint and Workforce Identity telemetry, connected sources, and manual artifacts. The buying question is which part of the control Iru can enforce, which part it only records, and who handles a failure.
| Part of the control | Iru's role | What the buyer must prove |
|---|---|---|
| Native device or identity state | Iru Endpoint or Workforce Identity can enforce supported controls and feed their state into Compliance Automation. | The required Mac and Windows controls work on the actual fleet; the dated artifact maps to the intended control. |
| Connected source | A connector collects and maps evidence from a separate system; it does not enforce that system's control. | Permissions, collection interval, stale-source alert, recovery history, and retention meet the audit need. |
| Program work | Tasks, policies, artifacts, and suggested control or action wording give the buyer a workflow. | An owner approves changes, remediates exceptions, checks scope, and keeps manual evidence current. |
| Independent examination | Restricted auditor roles and evidence export support review; Iru does not issue a SOC 2 opinion. | The intended CPA can access the control actions and artifacts it needs, obtain definitions another way if needed, and retain a usable evidence package. |
Sources: Iru Compliance Permissions, Adaptive Compliance, and the dated Iru record. These are documented capabilities and buyer checks. Auditor roles cannot view full control definitions under the documented permissions.
Iru’s AWS CloudTrail source guide gives a concrete limit to test: LookupEvents covers roughly 90 days of management events. Older trail history requires S3 archive access (s3:GetObject) and may require kms:Decrypt for customer-managed encryption keys. If your CPA needs a longer period, ask Iru to show the older events in a collected artifact; an active connector alone does not establish that coverage.
Iru’s Adaptive Compliance documentation describes a daily check for changes in connected sources or policy artifacts. It proposes changes to control and action wording for an Admin or Compliance Admin to approve; it does not change framework configuration, attachments, or readiness calculations. Test how that approval history relates to an open exception.
Iru’s standard agreement prohibits storing personal health data in the Services, and its HIPAA documentation says Iru does not store or manage PHI and does not require a BAA. A separately negotiated written agreement can take precedence. Keep PHI out of the evidence path under the published terms; if PHI is necessary, obtain the permitted scope and BAA position in the signed agreement. For Iru’s own service posture, request the current SOC 2 Type 2 report, a bridge letter if needed, the ISO certificate, and the materials behind its public security claims. The subprocessor list identifies AWS and several AI providers, but does not establish feature-level retention, training use, or processing-region terms. Put those commitments in the contract.
What can Iru MCP do?
Iru MCP lets Claude Desktop, Cursor, Codex, and other compatible clients use Iru’s endpoint API. Iru says a client can query devices and build reports using attributes, Blueprints, Library Items, vulnerabilities, and threats. With the right permissions, it can assign users and tags, configure Library Items, and lock, wipe, or isolate devices. Iru says user roles and API key permissions restrict access, while action allowlists specify what can run without confirmation. Iru says MCP is included with all its products.
Iru’s May 2026 launch post describes endpoint workflows; its examples do not establish MCP access to Compliance Automation controls or evidence. If your team wants to use MCP for SOC 2, have Iru show a read-only fleet report and a device action with limited permissions. Check how the device state reaches a SOC 2 control, who approves the action, and where Iru records it.
What do Iru reviews actually measure?
Public Iru customer reviews mainly describe the established endpoint product: Mac management, device security, day-to-day usability, and support. On September 18, 2026, G2 showed 4.7 out of 5 from 853 reviews, and Capterra showed 4.9 out of 5 from 493. These accounts help a buyer judge the IT experience of running an Iru-managed fleet.
One September 2026 G2 reviewer describes using enforced FileVault, escrowed recovery keys, and EDR deployment as audit evidence. G2 labels the review seller-invited and incentivized. Ask Iru to reproduce that evidence path with your own controls.
Gartner Peer Insights places Iru in Endpoint Management Tools. Its page showed 4.3 out of 5 from 29 ratings on September 24, 2026. Visible August reviews discuss device enrollment, app deployment, cloud-console permissions, and Mac migration. They do not rate the Compliance Automation workflow.
The Expert Insights evaluation, updated September 28, 2026, covers endpoint, identity, and compliance together. It reports stronger maturity on Apple devices and identifies Windows controls to test. Ask Iru to demonstrate those controls and provide a reference customer who has completed a SOC 2 observation period with a similar device mix, evidence sources, and auditor access model.
The ratings above belong to the cited platforms, not SOC2Auditors.org. Search results for Iru and Kandji also include employer reviews about working at the company.
How should you test Iru before buying?
Bring controls from your intended SOC 2 scope to the demonstration. Ask Iru to show each step and retain the resulting proof:
- Endpoint enforcement and response: Show a Mac and, if Windows is in scope, a Windows device failing and then meeting one required control. Keep the dated artifact and exception record. On Windows, also test behavioral EDR, automatic quarantine, and device isolation if your program requires them.
- Identity lifecycle: If Workforce Identity is in the quote, disable a test account. Show the access state, owner, timestamp, and mapped evidence.
- Connected evidence and history: Make a test source stale or revoke its credential. Show the alert, owner, collection interval, recovery, and history available to the auditor. For AWS CloudTrail, ask for a collected event older than roughly 90 days and show the S3 archive and decryption permissions used to obtain it.
- Manual exception: Upload an expiring artifact, assign an owner, and show the review date, exception, replacement, and retained history.
- Adaptive Compliance: Change a connected source or policy artifact. Show the suggested wording, Admin or Compliance Admin decision, and before-and-after record. Ask what happens to an open exception; this workflow does not remediate it.
- Policy acknowledgement: Have a test employee acknowledge a policy. Show the timestamped record and what happens when the policy is revised.
- CPA handoff: Have the intended CPA inspect a control action and artifact through a restricted role, request clarification, and export a sample. Confirm how it obtains full control definitions.
- Questionnaire and contracted modules: If Trust Center is in the quote, use a real questionnaire. Trace one draft answer to evidence and show who approves the response. Reconcile the signed order with every separately quoted Iru module used in these proofs, including Compliance Automation, Endpoint or EDR, Workforce Identity, and Trust Center as applicable; keep the licence metric, quantity, and term.
- Offboarding: Export controls, mappings, artifacts, comments, and policy history. Have the CPA check whether the files remain usable outside Iru.
Run these proofs before signing. Iru’s documented daily Adaptive Compliance check does not establish one collection interval for every connected source.
What can the CPA see in Iru?
Iru’s permissions documentation says Auditor and Compliance Auditor can view control actions and artifacts, generate automated artifacts, assess relevance, and comment. They cannot view full control definitions, edit controls, connect sources, or upload or delete artifacts.
Iru does not conduct the SOC 2 examination or issue the opinion. The buyer owns the program and remediation; the independent CPA firm determines scope, tests controls, evaluates exceptions, and issues the report.
Have your intended CPA test the restricted view and a sample export. Agree how it will receive missing definitions and retain evidence before the observation period. Confirm the firm’s Iru experience before signing; the restricted auditor role does not establish that experience. The auditor directory can help you find firms to ask.
How much does Iru Compliance cost?
Iru’s startup offer, checked September 29, 2026, starts at $9,000 per year for up to 25 endpoint devices, 25 mobile devices, and 25 Workforce Identity users. The annual package includes Endpoint Management, EDR, Vulnerability Management, Compliance Automation with Trust Center, and Workforce Identity. Iru sells additional seats in blocks of ten but does not list their price. The independent CPA examination is a separate cost.
The general pricing page asks buyers to request a quote by product and user or device count. Its free 14-day trial covers Workforce Identity, Endpoint Management, Vulnerability Management, and EDR; Compliance Automation and Trust Center require a personalized demo. Expert Insights reported Compliance pricing under $15,000 per year and a 50-license minimum for the package it reviewed on September 17, 2026. Iru’s startup page publishes different seat limits, so confirm the minimum for your order. Ask Iru to quote your modules, extra seats, support, renewal, export rights, and separate audit fee in writing.
Who should use Iru?
Shortlist Iru when native device evidence could remove a handoff your team otherwise has to manage. Use the proof steps on your own controls before choosing a platform.
If Vanta is also on your shortlist, Iru vs Vanta compares their compliance workflows, device-management costs and CPA access for a first SOC 2.
| Buying situation | Shortlist direction | Reason to test |
|---|---|---|
| Already use Iru Endpoint or want device management and SOC 2 evidence together | Iru | For supported controls, Iru feeds its endpoint state into Compliance without a separate MDM connector. Check coverage on your Mac and Windows fleet. |
| Keeping a separate MDM and seeking a longer compliance-product history | Vanta or Drata | Compare the connector-to-CPA path and total operating cost against Iru's combined quote. |
| Need supplier assessment and risk scoring in the same platform | Secureframe or a broader GRC product | Iru's public Compliance lineup does not advertise a native vendor-risk workflow. |
This compares buying models, not every feature or package. Iru's June 15, 2026 release says file-based Windows EDR and automated response are generally available. Expert Insights reported Windows behavioral detection and device isolation as planned for early 2027. Ask Iru to demonstrate the specific Windows detection and response your control requires.
The demonstration should leave you with an evidence sample, a list of work your team still owns, the CPA’s access requirements, and an itemized product quote. To put Iru beside other platforms, compare SOC 2 compliance software.
More in Compliance Tools