Pricing
You pay for audits + framework breadth — never per-resource or per-token. All plans include the same agent and the same evidence-citation engine; tiers differ in audit allowance, framework coverage, and support.
Starter
For small teams getting their first audit
$499/ month
- ✓ 5 audits / month
- ✓ Up to 3 AWS accounts
- ✓ WAR + SOC 2 Type I
- ✓ Email support · 30d retention
- ✓ Findings export (CSV / PDF)
- ✓ AWS Identity Center / IAM SSO
Most popular
Pro
The plan most teams pick
$1,499/ month
- ✓ 25 audits / month
- ✓ Up to 25 AWS accounts
- ✓ WAR + SOC 2 + ISO 27001 + HIPAA + NIST 800-53
- ✓ Org-wide audits (≤ 10 children per dispatch)
- ✓ Slack + email · 90d retention
- ✓ Customer-doc-driven hypotheses
- ✓ API access (read)
Enterprise
For regulated industries + multi-account orgs
Custom
- ✓ Unlimited audits
- ✓ Unlimited AWS accounts (org-wide auto-enroll)
- ✓ All frameworks + custom corpus + PCI DSS + FedRAMP
- ✓ 1-yr retention · CMK encryption
- ✓ SAML / SCIM / WorkOS AdminPortal
- ✓ Dedicated CSM · 1h response SLA
- ✓ API access (read + write) + webhooks
- ✓ Quarterly executive review
Annual billing available with a 15% discount. Custom invoicing for orgs above $50K ARR.
Plan comparison
| Capability | Starter | Pro | Enterprise |
|---|---|---|---|
| Audits / month | 5 | 25 | Unlimited |
| AWS accounts | 3 | 25 | Unlimited |
| WAR (6 pillars) | ✓ | ✓ | ✓ |
| SOC 2 (Type I) | ✓ | ✓ | ✓ |
| SOC 2 Type II evidence | — | ✓ | ✓ |
| ISO/IEC 27001:2022 | — | ✓ | ✓ |
| HIPAA Security Rule | — | ✓ | ✓ |
| NIST SP 800-53 Rev. 5 | — | ✓ | ✓ |
| PCI DSS v4.0 | — | — | ✓ |
| Custom corpus upload | — | — | ✓ |
| Org-wide audits | — | ≤10 children | Unlimited |
| Customer-doc claim verification | ✓ | ✓ | ✓ |
| Findings export (CSV / PDF) | ✓ | ✓ | ✓ |
| Codegen (CFT / Terraform / CDK) | ✓ | ✓ | ✓ |
| SOC 2 Type II evidence cycles | — | ✓ | ✓ |
| Type II hashed PDF export | — | ✓ | ✓ |
| Policy library (Comply + JupiterOne, MIT-licensed) | ✓ | ✓ | ✓ |
| Policy editor + version control | ✓ | ✓ | ✓ |
| Approval workflow (separation of duties) | — | ✓ | ✓ |
| Published-policy body-hash verification | — | ✓ | ✓ |
| GitHub audit (App + PAT auth, 12 tools) | ✓ | ✓ | ✓ |
| GitHub Enterprise Server (self-hosted) | — | ✓ | ✓ |
| Audit-readiness score (live, per framework) | ✓ | ✓ | ✓ |
| Blocker list (fix-this-first surface) | ✓ | ✓ | ✓ |
| Risk register (ISO 27005 / NIST 800-30 5×5 matrix) | ✓ | ✓ | ✓ |
| Treatment milestones + review attestation trail | — | ✓ | ✓ |
| One-click auditor packet (zip with SHA-256 chain) | — | ✓ | ✓ |
| Re-issuable packet (current state, fresh terminal hash) | — | ✓ | ✓ |
| Native POAM (owner + due date + status, no Jira required) | ✓ | ✓ | ✓ |
| POAM comment thread (append-only audit trail) | — | ✓ | ✓ |
| Evidence catalog (50+ types, per-tenant freshness) | ✓ | ✓ | ✓ |
| Catalog framework filter (165 citations) | ✓ | ✓ | ✓ |
| MDM integration (Jamf / Kandji / Intune) | — | ✓ | ✓ |
| Fleet posture rollup (CC6.7 evidence at-a-glance) | — | ✓ | ✓ |
| Microsoft 365 audit (Entra app-only, read-only Graph scopes) | ✓ | ✓ | ✓ |
| M365 admin enumeration (13 curated directory roles) | — | ✓ | ✓ |
| M365 MFA registration rollup (CC6.1 evidence) | — | ✓ | ✓ |
| Google Workspace audit (Admin SDK Directory, domain-wide delegation) | ✓ | ✓ | ✓ |
| Workspace admin enumeration (8 curated pre-built roles) | — | ✓ | ✓ |
| Workspace 2SV enrollment + enforcement rollup | — | ✓ | ✓ |
| Quarterly access review campaigns (CC6.3 / AC-2 / AC-6) | ✓ | ✓ | ✓ |
| Per-grant attestation (keep / reduce / revoke + reviewer) | ✓ | ✓ | ✓ |
| Access review CSV export (per campaign, AR-NNNN cite) | — | ✓ | ✓ |
| Vendor questionnaire import (CAIQ / SIG / cyber-insurance CSV) | ✓ | ✓ | ✓ |
| LLM-grounded evidence suggester (tool-gated catalog IDs) | — | ✓ | ✓ |
| Per-question approval trail (reviewer + timestamp, VQ-NNNN) | — | ✓ | ✓ |
| Employee roster + AUP signature tracking | ✓ | ✓ | ✓ |
| Training completion tracking (rolling window) | ✓ | ✓ | ✓ |
| HRIS integration (Rippling / Gusto / BambooHR / Workday) | — | Coming soon | Coming soon |
| Slack notifications | ✓ | ✓ | ✓ |
| Microsoft Teams notifications | ✓ | ✓ | ✓ |
| Jira ticket sync (with re-emission dedup) | — | ✓ | ✓ |
| Per-integration delivery audit log | ✓ | ✓ | ✓ |
| API (read) | — | ✓ | ✓ |
| API (write) + webhooks | — | — | ✓ |
| Retention | 30 days | 90 days | 1 year |
| SAML / SCIM SSO | — | — | Coming soon · add-on |
| Customer-managed KMS | — | — | ✓ |
| Support | Email · 2bd | Email + Slack · same-bd | Dedicated CSM · 1h |
Add-ons
Bolt these on to any plan. Coming-soon items have firm launch targets — buyers can pre-commit at quoted pricing.
SAML / OIDC SSO + SCIMComing soon
Enterprise single sign-on through your existing IdP (Okta, Azure AD, Google Workspace, Ping). SCIM auto-provisioning included. WorkOS-powered.
$300/mo
per SSO connection
EU data residencyComing soon
Tenant pinned to eu-west-1 / eu-central-1 with EU-only inference (Bedrock EU regions). Required for some GDPR / Schrems-II reviews.
$500/mo
Co-branded reports
Replace the CME wordmark + colour on PDF / HTML exports with your firm's brand. Used by partner consultancies + MSPs.
Included with Enterprise · Pro add-on $200/mo
Frequently asked
Do you charge per AWS account, per resource, or per audit?
Per audit. An audit is one dispatched run regardless of how many resources it covers. Org-wide audits count as one parent + one per child account.
What happens if I exceed my audit allowance?
The dashboard warns at 80%. Past the cap, audits queue until the next month or you upgrade. We never quietly bill overages.
Is the trial limited?
14 days, no card. You get the Pro plan during the trial. After 14 days the tenant moves to read-only until you choose a plan.
Can I bring my own framework?
Enterprise only. You upload a corpus (HTML/PDF) and the agent indexes it as another framework. We don't restrict you to AWS-published controls.
How does pricing compare to Vanta / Drata?
Starter is cheaper than Vanta's SOC2-only entry tier. Pro covers 5 frameworks where Vanta charges for each separately. Enterprise is custom because the wedge is unbounded — see /vs/vanta for a structured comparison.
14 days. No card. No CSV.
Connect one AWS account, run your first audit, and decide afterwards whether the findings are worth the price.
Start free trial