Pricing
Conformiti is MIT licensed. Self-host it and the whole programme is yours at no cost, for ever. There are three things to buy, and each is bought on its own.
The complete platform, on your infrastructure, under a licence that lets you fork it. No seat meter, no licence server, no telemetry, and nothing switched off waiting to be paid for.
Included in the free build
Support is the community: GitHub issues and discussions. The Pro and Enterprise editions install on top of this build; they add to it and take nothing away.
Editions
Neither of them unlocks anything. They are separate packages, written after the fact, adding nineteen features that did not exist in the core build.
Run your own programme on your own hardware.
MIT, for ever. Unlimited people.
One organisation that wants the programme to draft and test itself.
Per installation. Unlimited people.
A consultancy, MSP or audit firm carrying many client programmes.
Per partner firm, plus $900 per client workspace a year.
Prices in USD, excluding sales tax, per installation per year. A licence is a signed file, no licence server, no phone-home. When it expires the paid features go read-only and Core carries on untouched.
Compliance packs
HIPAA, GDPR, NIST 800-53 and CSF 2.0, CMMC, CIS v8, DORA, NIS2, ISO 42001, 27017, 27018, 27701 and 22301, SOX ITGC, FedRAMP, PIPEDA, Law 25, PHIPA, FIPPA, OSFI B-13, ITSG-33, CCPA. Each crosswalked, so evidence already mapped to SOC 2 counts immediately.
One pack
from $1,200
Any single library, installed and crosswalked.
A themed bundle
from $1,800
Privacy, EU resilience, the NIST family, or CSF with CIS.
All twenty-two
$8,900
Every library in the build, with newer builds while maintenance runs.
Packs are perpetual: a pack you have bought keeps working for ever, and a renewal buys newer builds rather than continued access. See every pack, its control count and its copyright posture.
Managed hosting
Your evidence never leaves your network. No telemetry, no licence server, no proxy, and a copilot that talks to your model provider with your key. No region binding to negotiate, because the region is yours.
If you would rather not run the server, we will. It is a serious operational commitment, and it is priced like one.
Quoted per engagement on scope, data volume and the response times you need. Expect it to cost considerably more than the licence and your own infrastructure would.
Why these are not licence add-ons. Data residency and API rate limits are hosting operations. On an install you run yourself a region binding or a throttle is unenforceable, so we do not charge for one.
Support
Every edition carries support. These are the upgrades, for teams whose auditors will ask who stands behind the system.
Public issues and discussions on GitHub, answered when we get to them.
A private channel, upgrade help, and advisories before they are public.
We are on the hook for the upgrade window, not just the advice.
main and everyone gets them.
Consulting
Software does not write your Statement of Applicability, chair your management review, or collect a quarter's access reviews out of six systems. We do that inside your organisation, and leave you a running management system rather than a report about one.
| ISMS stand-up: scope, risk method, Statement of Applicability, the policy suite, internal audit programme and the first management review | from $24,000 |
|---|---|
| Policy and procedure authoring: your policy suite written to your organisation, approved by you, mapped to every control | from $9,500 |
| Done-for-you evidence · sprint | $9,800 |
| Done-for-you evidence · retainer | $5,900/mo |
| Readiness assessment | $6,500 |
| Implementation & rollout | $18,000 |
| Audit preparation & PBC run | $12,000 |
| Fractional GRC retainer | $4,800/mo |
| Day rate | $1,850 |
The small print
No. It is MIT licensed with no expiry, no seat count and no telemetry. Fork it if you like. Most people will never pay us anything, and that is the deal.
Because it is the option we would rather you did not take. Running your evidence on our infrastructure gives up the architectural promise the product is built on, so it is priced as the serious operational commitment it is rather than as a convenient default.
Only if you want newer builds. A pack you have bought keeps working for ever at the version you bought. Maintenance buys revisions when the standard changes, which for a live standard is the expensive part.
Prices are in USD and exclude sales tax, GST/HST and VAT. Canadian customers can be invoiced in CAD at the prevailing rate.
It is the whole programme. If it holds up against your own evidence, the paid editions are a signed file away.