Conformiti
GitHub Book a demo
ProductEditionsPricing ConsultingSelf-hostDocs Security GitHub Book a demo

Pricing

Free to run.
Two editions when you need more.

Core is AGPL-3.0 and free for ever. Pro and Enterprise are annual licences that install on top, with the compliance packs included.

Shipping · v0.9.5oe

Core

The whole program, on your hardware.

$0

AGPL-3.0, for ever. Unlimited people.

Install it free
  • SOC 2, ISO 27001 and PCI DSS: 217 controls
  • Sealed, signed audit packages
  • SSO, vendor risk, workspaces and the full API
  • Community support on GitHub
Most teams
Built · v1.9.5

Pro

One organisation that wants the program to draft and test itself.

$8,900/ year

Per installation. Unlimited people.

Buy Pro

See the Pro tour · How Pro installs

  • 27 features, led by the Conformy assistant, control testing and the trust centre
  • Including policy approvals, privacy requests, an assurance report reader and an OSCAL system security plan
  • All 27 compliance packs: 2,430 controls
  • 30 policies and 14 registers, pre-mapped, with 120 starting risk scenarios
  • Email support, next business day
Built · v1.9.5

Enterprise

Multi-headed business units, one measure of compliance.

$24,900/ year

Ten business units or client workspaces included. $900 a year for each one beyond.

Talk to us

See the Enterprise tour

  • Everything in Pro, with all 27 packs, for every unit and client
  • Business units: every unit held to one baseline and read with one measure of readiness
  • Shared controls run once and adopted by each unit, an audit scope map, the group vendor directory and a board pack
  • Group readiness across every unit and client, with a read-only feed for your data platform
  • Identity provisioning over SCIM 2.0: accounts and leavers kept by your identity provider
  • Multi-client console and partner role, for firms that serve many clients
  • White-label: brand, domain, sender, sign-in
  • TPRM Advanced: scoring, exposure, DORA register
  • Per-engagement licences for outside auditors
  • Email support, next business day

USD, excluding tax. A licence is a signed file, with no licence server and no phone-home. If it lapses, the paid features go read-only and Core carries on. Compare the editions line by line.

An add-on for Pro or Enterprise: the assistant panel, priced per installation.

How buying works

01: ASK

Tell us what you need

Use the contact form and pick Pro or Enterprise. A person replies within one business day.

02: ORDER

Get the order and the invoice

Invoices are in USD, or CAD for Canadian clients, excluding sales tax, GST/HST and VAT. Add your installation's fingerprint (Licence page) to tie the licence to that one installation.

03: INSTALL

Install a signed file

The licence is one file, checked offline when you install it. No licence server, no activation call, no phone-home. How Pro installs.

Compliance packs

The packs come with Pro.

Each one is crosswalked, so evidence you have already mapped counts on day one.

Pro · 27 packs

  • NIST CSF 2.0
  • NIST SP 800-53 Rev. 5
  • NIST SP 800-171 / CMMC L2
  • CIS Controls v8
  • HIPAA Security Rule
  • SOX ITGC
  • ISO 22301
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • GDPR
  • CCPA / CPRA
  • PIPEDA
  • Quebec Law 25
  • PHIPA
  • FIPPA / MFIPPA
  • ISO/IEC 42001 (AI management)
  • NIST AI RMF 1.0
  • EU AI Act
  • FedRAMP Moderate
  • DORA
  • NIS2
  • OSFI B-13
  • CCCS ITSG-33
  • UK Cyber Essentials
  • Essential Eight
  • EU Cyber Resilience Act

Need one pack without an edition? Talk to us. Control counts per pack.

Everything else

Ask, and we will quote it.

Managed hosting

A single-tenant instance in Canada or the US, run by us. Quoted on scope.

Ask for a quote

A single pack

One framework without an edition, or one we do not ship yet.

Tell us which

Faster support

A named contact, or upgrades done with you.

Talk to us

Consulting

We stand up the program and collect the evidence with you.

How we work

Is Core time-limited?

No. AGPL-3.0, no expiry, no seat count, no telemetry. Most people will never pay us, and that is fine.

What if a licence lapses?

The paid features go read-only. Core keeps running and nothing is deleted.

Currency and tax?

USD, excluding sales tax, GST/HST and VAT. Canadian clients can be invoiced in CAD.

Core and its three libraries are AGPL-3.0 and public. The editions and packs are commercial and not in the public repository. Nothing in Core moves behind a licence.

Try the free one first.

If it holds up against your own evidence, the paid editions are a signed file away.

Install Conformiti Core Book a demo