Simple, seat-based pricing
Start free for 1 year, no card. Then buy by seat, named users, not headcount. Every edition is the full platform with all 20 frameworks; the only thing that changes between plans is how many seats you provision.
- All 20 frameworks, every plan
- Seats, not headcount
- Free 1-year trial
- Air-gap on any plan
- Frameworks, every plan
- 20
- Controls shipped
- 2,082
- Free trial
- 1 year
- Trial seats
- 25
One platform, priced by seat
Annual list prices, licensed by named user. Start on the free trial, then buy the plan that fits your team; a purchased key activates straight over the trial.
Team
- The full platform, all 20 frameworks (2,082 controls)
- Automated assessments and the tamper-evident audit trail
- A2A attestation and A2A Alerts included
- Self-hosted on your own infrastructure
Growth
- Everything in Team, with more seats
- Seats for operators, control owners, your auditor and your MSP
- Cross-framework reuse across all 20 frameworks
- Air-gapped deployment available by quote
Scale
- Everything in Growth, with more seats
- Multi-entity A2A attestation across teams and vendors
- Board packs and auditor evidence views
- Air-gapped deployment available by quote
Unlimited or custom seats
For organisations that need custom seat counts, multiple entities, or procurement, security-review and MSA terms. Same binaries, same full platform; we quote and invoice against a PO.
Add-on: air-gapped deployment
$15,000, sold by quote and available on any plan. A fully disconnected install with local vLLM inference in place of cloud model providers, so no evidence or traffic leaves your network. Ask for an air-gap quote.
Trial-then-buy, priced by seat
No self-serve checkout and nothing auto-renews. Here is exactly what a licence does, and what happens when one lapses.
Every plan is the full platform
All 20 frameworks, 2,082 controls, automated assessments and A2A attestation ship in every plan, the trial included. Nothing is held back for a bigger tier.
A seat is an active user
A seat is any active user record: operators, control owners, your auditor, your MSP. People without an account cost nothing, and the seat ceiling is signed into your key.
Trial, then buy
Start with a free 1-year, 25-seat trial key, issued instantly with no credit card. When you buy, the purchased key activates straight over the trial, no reinstall.
Lapses lock writes, not data
An unlicensed or expired install returns 403 license_required on writes, but your data stays readable and every export keeps working. Nothing is deleted.
Air-gap on any plan
Air-gapped deployment is a $15,000 add-on available on any plan, quoted separately. Local vLLM inference replaces cloud model providers; nothing phones home.
Self-hosted, no lock-in
GRCFlow runs on your own infrastructure. Your evidence, risk register and audit trail live in your own database; stop paying and nothing is taken away.
Try it free for 1 year
All 20 frameworks and 2,082 controls ship with the trial key, 25 seats, no credit card. Install is one command, and nothing renews on its own.