Editions
Core is the whole compliance program, free under the AGPL-3.0. Pro and Enterprise install on top as signed licence files. They add features and compliance packs, and take nothing out.
Your own program, on your own hardware.
Free for ever. No trial, no seat count.
One organisation that wants the program to draft and test itself.
Per installation. Unlimited people.
See the Pro tour · How Pro installs
Multi-headed business units, one measure of compliance.
Ten business units or client workspaces included. $900 a year for each one beyond.
Paid features are added on top, never carved out of Core. A licence is a signed file: no licence server, no phone-home, and if it lapses the paid features go read-only.
Pro · Conformy
It works from your controls, documents, risks and vendors, and every answer names its sources.
Rules enforced in code
27 features and every compliance pack, for one organisation that wants the program to draft and test itself.
Frozen populations, re-derivable samples, independent sign-off, and an Excel workpaper.
305 test procedures across 61 criteria, run by the testing workflow.
Standing requests on a cadence, chased and escalated.
Sign-off pinned to the exact version and its digest. Assign training and keep the attestations auditors ask for.
An approval chain on the folder that holds your policies: ordered steps, steps that need two of three approvers or open together, one decision for each person, and nobody approves a version they uploaded. Every decision is kept with the file's digest, and the last one files a signed record as evidence.
A public page that shows your posture to prospects. It charts daily page views and report requests, and the request funnel (views, requests, terms accepted, approvals), as counts only, with a CSV export.
Visitors ask in their own words. The answer comes from the answers you approved, or from your page's own words through your model key, and a reply is shown only when its figures, its addresses and most of its words are on the page. Otherwise the visitor is pointed to a request.
Upload a prospect's questionnaire and get a drafted answer for each question, with its sources. A person approves every answer.
Flags personal data in evidence and makes masked copies for packages.
Access, deletion and correction requests, with the deadline worked out for the GDPR, the UK GDPR, the CCPA, PIPEDA and Quebec's Law 25, counted with your own holidays, through a public request form you can switch on, and a reply drafted from your own wording. The requester's details are encrypted, and removed a set time after the request closes, leaving the dates and the outcome.
DocuSign, Dropbox Sign or a manual flow, and the signed copy files itself. Vendor, standards and expiry are proposed from the signed contract.
Upload a vendor's SOC 2 report, ISO certificate or penetration test summary. Your model key proposes the period, the opinion, the exceptions and the controls left to you, each with the passage it came from, and nothing is written until a person confirms it.
Reporting packs with the numbers frozen when they are generated.
Your NIST SP 800-53 or FedRAMP Moderate program as an OSCAL 1.1.3 system security plan in JSON, with the value you set for each parameter and how the system meets each control, checked against NIST's own schema and catalog. A control that does not map is named, never guessed.
Real Teams and Meet invites from the governance calendar.
Notes beside any control, risk, vendor or document. Tag a colleague and it reaches their notifications.
Import your people and the accounts in your other systems, then run the leaver test: every account still active after someone left. Run an access review over the same accounts: one decision per account that cannot be edited afterwards, and a completion report filed as evidence. It never changes an account anywhere.
One row for every person in scope: their policies, their training, their device and their background check, each due from the day they started or joined the list, with windows you can set by department and reminders you can switch on. An exemption is a record with a reason, and the report is filed once as evidence.
Import scanner findings, set deadlines by severity, accept a risk with an approver and an expiry, and raise Jira Cloud tickets.
Give an assistant on your own machine a personal token and it reads your program: controls, risks, vendors and deadlines. It sees what you see and can change nothing. Off until you turn it on.
Events from your program are posted, signed, to your own https endpoints, retried when a delivery fails and logged. Nothing is sent to a host the operator has not named.
Your own scripts report results against controls with a token you make. Off until you turn it on, and it never connects out. A result never marks a control implemented.
Import a device management export and see which devices fail a baseline you confirm. The same page lists the systems in your account imports that are not in the vendor register. It never contacts a device.
30 policies and 14 registers, pre-mapped, plus your own frameworks. One register is a library of 120 starting risk scenarios that import into your risk register.
Multi-headed business units, one measure of compliance. Everything in Pro, plus these eight. See them on the Enterprise tour.
For a company with multi-headed business units. Each unit keeps its own workspace and its own frameworks; the group holds every unit to one baseline and reads them with one measure of readiness. A theme can be switched off for a unit it does not fit, and a gap excused for a time. Nothing is averaged.
Run single sign-on, monitoring or background checks once, at group level. Each unit adopts the control for its own, with signed evidence filed in its library and refreshed when the group's control changes.
One audit across several units on one screen: each unit's package, the auditor requests open and overdue, and auditor access that has outlived the period. And one file for the board: the units least ready first, the baseline, the exceptions ending soon, the audits and the vendor concentration.
The providers several units depend on, counted across the group: in how many units, how many as critical, how many with lapsed assurance. One register of information for the group.
Control volume and readiness for every business unit and client you reach, on one page, units and clients together and never averaged, with a CSV and a year's trend. A read-only feed for your data platform carries the same figures, on tokens you make, see the use of and revoke.
Your identity provider keeps each unit's accounts over SCIM 2.0: a person you assign gets an account, their role follows the groups you map, and a leaver is deactivated and signed out at once. One connection per unit on a token that expires; the last administrator is protected, and every change is in the audit trail.
Readiness, overdue work and search across every client, with a partner role, and your brand on the sign-in page, the app, every email and every report.
Questionnaire scoring, exposure ranking, fourth parties and the DORA register.
Sold on top of Pro or Enterprise, and priced per installation. Ask us.
An assistant on every page. Ask about the control or vendor on screen, or about the whole program, and the answer comes from your own records, with links to the ones it used, on your own model key. It reads only what you can open and changes nothing. Needs Conformy.
From its own signed zip, with the installer in your Pro package, which checks the signature first. It sits beside Pro, so upgrading Pro leaves it in place, and removing it leaves Pro as it was.
Line by line
| Core Free · AGPL-3.0 |
Pro | Enterprise | |
|---|---|---|---|
| The program, in every edition | |||
| SOC 2 · ISO 27001 · PCI DSS (217 controls) | ✓ | ✓ | ✓ |
| Sealed audit packages, Ed25519 signatures | ✓ | ✓ | ✓ |
| SSO, passkeys, TOTP | ✓ | ✓ | ✓ |
| Auditor portal, scoped per package | ✓ | ✓ | ✓ |
| Vendors, questionnaires, responsibility matrices | ✓ | ✓ | ✓ |
| Risk, access reviews, meetings, RACI, Jira | ✓ | ✓ | ✓ |
| Workspaces and the full REST API | ✓ | ✓ | ✓ |
| People | Unlimited | Unlimited | Unlimited |
| Pro | |||
| Conformy, the AI compliance assistant (your model key) | No | ✓ | ✓ |
| Public trust centre | No | ✓ | ✓ |
| Answers on the trust centre (from your approved answers and your page) | No | ✓ | ✓ |
| Control testing and the SOC 2 Type II pack | No | ✓ | ✓ |
| Recurring evidence collection | No | ✓ | ✓ |
| Policy acknowledgement and awareness training | No | ✓ | ✓ |
| Policy approvals (an approval chain on a folder) | No | ✓ | ✓ |
| Personal-data detection and masking | No | ✓ | ✓ |
| Privacy requests (GDPR, UK GDPR, CCPA, PIPEDA, Law 25) | No | ✓ | ✓ |
| E-signature and contract auto-extract | No | ✓ | ✓ |
| Assurance report reader (proposals you confirm) | No | ✓ | ✓ |
| Board reporting and the meeting scheduler | No | ✓ | ✓ |
| OSCAL system security plan (NIST SP 800-53, FedRAMP Moderate) | No | ✓ | ✓ |
| Notes and mentions | No | ✓ | ✓ |
| Security questionnaire automation (answering a prospect's) | No | ✓ | ✓ |
| People and access, with the leaver test | No | ✓ | ✓ |
| Personnel compliance, person by person | No | ✓ | ✓ |
| Vulnerability and remediation | No | ✓ | ✓ |
| AI assistant connection (read-only, off until you turn it on) | No | ✓ | ✓ |
| Outbound webhooks (signed, to your own https endpoints) | No | ✓ | ✓ |
| Evidence push API (off until you turn it on, never connects out) | No | ✓ | ✓ |
| Devices and vendor discovery | No | ✓ | ✓ |
| Custom framework builder | API only | ✓ | ✓ |
| 30 policies and 14 registers (including 120 starting risk scenarios) | No | ✓ | ✓ |
| Compliance packs | No | All 27 | All 27 |
| Enterprise | |||
| Business units: one baseline and one measure of readiness across units | No | No | ✓ |
| A theme switched off per unit, and time-boxed exceptions | No | No | ✓ |
| Shared controls, adopted by each unit with signed evidence | No | No | ✓ |
| Audit scope map across units | No | No | ✓ |
| Group vendor directory and the group register of information | No | No | ✓ |
| Group board pack | No | No | ✓ |
| Group readiness across every unit and client you reach, with a read-only feed (never averaged) | No | No | ✓ |
| Identity provisioning over SCIM 2.0 (accounts, roles and leavers from your identity provider) | No | No | ✓ |
| Multi-client console and partner role | No | No | ✓ |
| White-label | No | No | ✓ |
| TPRM Advanced | No | No | ✓ |
| Business units or client workspaces | Unlimited | Your own org | 10 included, then $900 a year each |
| Add-ons, sold separately | |||
| Assistant panel (on top of Pro or Enterprise) | No | Add-on | Add-on |
| Support | |||
| Support | Community | Email, next business day | Email, next business day |
Rather we ran the server? Managed hosting is quoted on scope.
Compliance packs
SOC 2, ISO 27001 and PCI DSS ship free in Core. Pro includes all 27, and Enterprise carries them through Pro, each crosswalked to what you already run.
| Pack | Controls | Pro | Enterprise |
|---|---|---|---|
| NIST SP 800-53 Rev. 5 | 527 | ✓ | ✓ |
| ISO/IEC 27701 | 188 | ✓ | ✓ |
| CIS Controls v8 | 153 | ✓ | ✓ |
| NIST SP 800-171 / CMMC L2 | 110 | ✓ | ✓ |
| NIST CSF 2.0 | 106 | ✓ | ✓ |
| FedRAMP Moderate | 90 | ✓ | ✓ |
| PIPEDA | 85 | ✓ | ✓ |
| EU Cyber Resilience Act | 85 | ✓ | ✓ |
| FIPPA / MFIPPA | 83 | ✓ | ✓ |
| HIPAA Security Rule | 81 | ✓ | ✓ |
| CCCS ITSG-33 | 78 | ✓ | ✓ |
| DORA | 73 | ✓ | ✓ |
| NIST AI RMF 1.0 | 72 | ✓ | ✓ |
| Quebec Law 25 | 70 | ✓ | ✓ |
| ISO/IEC 42001 (AI management) | 70 | ✓ | ✓ |
| OSFI B-13 | 62 | ✓ | ✓ |
| GDPR | 59 | ✓ | ✓ |
| PHIPA | 53 | ✓ | ✓ |
| EU AI Act | 52 | ✓ | ✓ |
| CCPA / CPRA | 49 | ✓ | ✓ |
| ISO 22301 | 47 | ✓ | ✓ |
| ISO/IEC 27017 | 46 | ✓ | ✓ |
| SOX ITGC | 45 | ✓ | ✓ |
| ISO/IEC 27018 | 43 | ✓ | ✓ |
| NIS2 | 40 | ✓ | ✓ |
| UK Cyber Essentials | 37 | ✓ | ✓ |
| Essential Eight | 26 | ✓ | ✓ |
ISO and CIS packs carry the clause identifiers with our own wording, so you need a licence for the standard itself. The UK Cyber Essentials and Essential Eight packs are also in our own wording: keep the NCSC and ASD documents beside them. ASD has announced that its Essentials series will replace the Essential Eight; the 2023 maturity model is still the one assessed against and the two are expected to run side by side. Other public law and government guidance is rendered faithfully. Need one pack on its own? Talk to us.
How the paid editions install
No licence server, no activation call, no telemetry.
$ python install.py --check --target /srv/conformiti → every backend file, SPA file and patch listed → every migration listed · nothing written $ python install.py --target /srv/conformiti --license company.json → archive checksums and Ed25519 signature verified → installed · pro_doctor: all checks pass $ python manage.py pro_license --features Licensed to Your Company Ltd Plan pro Expires 2027-10-01 Features copilot yes, trust yes, ...
--check shows every file, patch and migration, and writes nothing.pro_doctor, and rolls back more than one version.pro_doctor compares every file with the release's signed checksums and names any that was edited, is missing or was added. It is evidence for support, not a lock.--offline.Questions
No. Core stays free and public under the AGPL-3.0. Paid features are additions in a separate package.
The paid features go read-only. Core carries on, and your evidence, packages and signatures are untouched.
No. There is no callback, no usage report and no proxy. The AI features call your own model provider with your key, under your agreement with it.
It is already free in Core. TPRM Advanced adds scoring, exposure ranking, fourth parties and DORA.
Install Core, load your evidence and seal a package. If it holds up, Pro is a file away.
Questions about editions, packs or partnering: sales@conformiti.app.