What it costs
Three tiers by what you are certifying, not by seats. We quote against your scope rather than publishing a number that would be wrong for most of the companies reading it.
Three tiers, by what you are certifying
Implementation and audit coordination are quoted with your programme. Audit fees are paid to your certification body or CPA firm and are not ours to charge.
One framework
Talk to us
Priced on your headcount and the frameworks in scope
ISO 27001 or SOC 2. The platform, with your named practitioners.
- Full platform, one framework
- Named GRC lead and vCISO access
- Automated evidence from the systems you connect
- Auditor coordination
Both frameworks
Talk to us
Priced on your headcount and the frameworks in scope
Both certificates on one control set. Evidence carries across.
- ISO 27001 and SOC 2 together
- One control set, evidence collected once
- Named GRC lead and vCISO access
- Auditor and CPA coordination
Enterprise
Custom
Priced on the number of entities and the terms you need
Multiple entities on one control set, with commercial terms to match.
- Multi-entity programmes
- One control set across every entity
- India data residency on AWS Mumbai
- Custom commercial terms
Three things move the number
How many people are in scope
Access reviews, awareness training, and joiner and leaver evidence all scale with the size of the team, so headcount is the first thing we ask about.
One framework or both
ISO 27001 and SOC 2 sit on one control set, so evidence collected for the first counts towards the second. Both together costs less than running the two programmes apart.
How much of the programme we run
The platform is the same either way. What changes is the consulting engagement: whether a named GRC lead runs your programme, or supports a team you already have.
Part of the engagement, not separate line items
- Security awareness trainingDelivered by magic link, with completion records mapped to the controls that ask for them.
- Third party riskQuestionnaire responses, submitted documents and external attack surface data on every vendor you track.
- Cloud postureContinuous misconfiguration checks across your cloud accounts, mapped to the controls each finding affects.
- Three-year platform accessPlatform access is agreed across a three-year term, so year two and year three are not a fresh negotiation.
- The consulting engagementA named GRC lead and vCISO access are part of the engagement, not a separate retainer.
What we are asked before the quote
Is the audit fee included?
No. The certification body for ISO 27001 and the CPA firm for SOC 2 are independent of us and invoice you directly. That independence is what makes the certificate worth holding. We coordinate the audit and prepare the evidence, and we tell you the range to expect before you commit.
What happens at renewal?
Certification is not a one-off. ISO 27001 runs surveillance audits and SOC 2 Type II covers a period rather than a moment, so the programme continues after the first certificate. Platform access and your named practitioners run on the terms already agreed rather than being repriced each year.
Do you charge per user?
No. There is no per-seat licence. Headcount informs which tier fits, because the work scales with the size of the team, but adding a person does not add a line to your invoice.
Is there a minimum term?
Yes, three years. A first certification takes months rather than weeks, and surveillance follows it. A shorter term would end in the middle of your own audit cycle.
Tell us your scope and we will price it
Headcount, which framework, and whether you have anyone running the programme today. That is enough for a number. The call opens the product, not a deck.