Every price is on this page
No call to find out what it costs. Start free in a self-serve demo workspace and pay for the capacity you actually use.
For small teams formalising a third-party risk program.
- Up to 5 users
- Up to 25 vendors
- Assessments and vendor portal
- Continuous monitoring
- Email support
For scaling teams running recurring assessment cycles.
- Up to 15 users
- Up to 100 vendors
- Everything in Starter
- Regulatory registers
- AI governance (preview)
For mid-market programs with active vendor portfolios.
- Up to 40 users
- Up to 500 vendors
- Everything in Growth
- Approval workflows
- Priority onboarding
For regulated and audit-heavy organisations.
- Unlimited users and vendors
- Everything in Scale
- SAML SSO, RBAC, API
- SLA, DPA and EU/US residency
- Dedicated success
All paid plans start with a 14-day trial, with no credit card to start. Annual and invoiced billing are available on request for Scale and Enterprise.
Every plan, side by side
| Starter | Growth | Scale | Enterprise | |
|---|---|---|---|---|
| Limits | ||||
| Vendors | Up to 25 | Up to 100 | Up to 500 | Unlimited |
| Users | Up to 5 | Up to 15 | Up to 40 | Unlimited |
| Third-party risk operations | ||||
| Vendor register and risk rubric | ✓ | ✓ | ✓ | ✓ |
| Assessments, templates and question bank | ✓ | ✓ | ✓ | ✓ |
| Vendor portal for supplier responses | ✓ | ✓ | ✓ | ✓ |
| Explainable composite risk scoring | ✓ | ✓ | ✓ | ✓ |
| Issues, incidents and remediation | ✓ | ✓ | ✓ | ✓ |
| Contracts, renewal radar and SLA dates | ✓ | ✓ | ✓ | ✓ |
| Concentration and exposure analysis | ✓ | ✓ | ✓ | ✓ |
| Your own published Trust Center | ✓ | ✓ | ✓ | ✓ |
| Continuous monitoring | ||||
| Monitoring sources | 9 | 10 | 11 | 14 |
| Sanctions, adverse media and registry | ✓ | ✓ | ✓ | ✓ |
| Attack surface, CVE and web posture | ✓ | ✓ | ✓ | ✓ |
| Commercial OpenSanctions index | — | ✓ | ✓ | ✓ |
| urlscan Pro URL detonation | — | — | ✓ | ✓ |
| Breach, leak and threat telemetry | — | — | — | ✓ |
| Security ratings with your own key | ✓ | ✓ | ✓ | ✓ |
| Regulatory reporting | ||||
| Regulatory registers (6) | — | ✓ | ✓ | ✓ |
| Submission history and change diff | — | ✓ | ✓ | ✓ |
| CSV, XLSX and XBRL submission export | — | ✓ | ✓ | ✓ |
| AI governance (preview) | — | ✓ | ✓ | ✓ |
| Reporting and workflow | ||||
| Risk register and board packs | ✓ | ✓ | ✓ | ✓ |
| Scheduled reports | ✓ | ✓ | ✓ | ✓ |
| Approval workflows | — | — | ✓ | ✓ |
| Platform and security | ||||
| Roles and permissions | ✓ | ✓ | ✓ | ✓ |
| Multi-factor authentication | ✓ | ✓ | ✓ | ✓ |
| Activity log | ✓ | ✓ | ✓ | ✓ |
| API keys and webhooks | — | — | ✓ | ✓ |
| SAML SSO | — | — | — | ✓ |
| SLA, DPA and EU/US residency | — | — | — | ✓ |
| Support | ||||
| Support | Priority | Priority + onboarding | Dedicated | |
Monitoring sources are counted by the provider each plan carries the cost of: nine on every plan, then the commercial OpenSanctions index, urlscan Pro, and the three premium breach and telemetry feeds. See every source. The six regulatory registers are DORA, NIS2, UK SS1/21, US OCC 2023-17, MAS TRM and APRA CPS 230. AI governance covers the EU AI Act inventory and FRIA, the ISO/IEC 42001 Annex A statement of applicability and the NIST AI RMF maturity register, and is in preview. What preview means.
Questions, answered
Can I change plans at any time?
Yes. Upgrade, downgrade or cancel from billing settings. Changes are prorated and handled through Stripe.
Is there a free trial?
Two, in effect. A self-serve demo workspace spins up in about two minutes, comes pre-populated, needs no credit card and expires after seven days. Every paid plan then starts with a 14-day trial that converts only when you add payment.
What if I outgrow the limits?
Plans are sized by users and vendors: Starter 25, Growth 100, Scale 500, Enterprise unlimited. Upgrading is a click and nothing is migrated.
What payment methods do you take?
Major cards via Stripe. We collect a VAT number and billing address at checkout so the invoice is right the first time.
Not sure which plan fits?
Tell us how many suppliers are in scope and what you have to report.