GRCFlow pricing you can audit

Every edition ships the same binaries with the full platform and all frameworks. Tiers differ only in seats, license term, and deployment mode — and the matrix below maps 1:1 to the license gates actually enforced in the open codebase.

No framework tax

All 20 frameworks / 2,082 controls — including the full NIST SP 800-53 Rev. 5 catalogue (1,014 controls), CMMC L1–L3, NIST 800-171, NIST CSF 2.0, ISO 27001, SOC 2, PCI DSS 4.0.1, HIPAA, GDPR, CCPA, GLBA, NYDFS 500, DORA, NIS2, TISAX, plus the AI-governance pack (ISO/IEC 42001, NIST AI RMF, EU AI Act) — are in every edition, including free Community. There are no per-framework flags anywhere in the code: the platform-wide require_active_license gate is what stands between you and every framework. Two module-level gates do exist and we name them both — require_feature("a2a"), which is granted in every edition including free Community, and require_cloud_tier, which switches cloud connectors off on air-gap keys by design. Neither one is an upsell.

No surprise renewal

Licenses are Ed25519-signed keys with a hard expiry date shown in the app. There is no auto-renew mechanism in the product — renewing is always a deliberate action. When a key expires the API returns 403; nothing is deleted and your data stays in your Postgres.

No lock-in

Self-hosted on your infrastructure. Your evidence, risks, and audit trail live in your own database and object storage. Stop paying and you keep your data — and the free Community Edition keeps running.

Price transparency note: we have not published final list prices yet. Anything shown as “Contact for quote” is a placeholder, not a final price. Only “Free” is final: the Community Edition costs nothing, requires no key, and has no time bomb. We will publish list prices on this page — not hide them behind a call.

Three editions, one codebase

Community is free and final. Professional and Enterprise are quoted on contact until we publish list prices — they add seats and deployment options, never features or frameworks.

Community

Free · self-host
Final. No key, no signup, and no expiry cliff — a rolling 90-day licence that refreshes on every backend restart.
Built into the self-host install. Activates automatically when the backend runs with AUTH_MODE=local — what the one-line installer sets — with the same binaries and same feature set as paid tiers.
  • Full platform — every module, all 20 frameworks
  • 5 seats (enforced at user create/invite)
  • A2A vendor attestation included
  • Cloud data-source connections (AWS/Azure)
  • Rolling 90-day license, auto-refreshes on restart
  • Optional 30-day signed trial key (5 seats)
Install Free

Professional

Contact for quote
Placeholder — final list price not yet published.
A 1-year Ed25519-signed key for teams past 5 users. Same platform, more seats, fixed term.
  • Everything in Community
  • 25 seats (default — seat count is signed into your key)
  • 1-year license term, validated offline
  • Hard expiry date visible in-app — no auto-renew
  • Email support
Contact Sales

Enterprise

Contact for quote
Placeholder — final list price not yet published.
Custom seat counts and the air-gap deployment tier for regulated environments.
  • Everything in Professional
  • 100+ seats (custom, signed into your key)
  • Air-gap tier available: fully offline validation, local vLLM
  • Cloud connectors intentionally disabled on air-gap keys
  • Custom license terms
Contact Sales

The entitlement matrix, traced to code

Most vendors publish a marketing grid. Ours cites the exact server-side gate that enforces each row — the source is public, so you can verify every claim. See also the GRCFlow platform comparison and the full framework and control reference.

Capability Community Professional Enterprise How it is enforced
Full GRC platformAssessments, risks (FAIR + residual), incidents, policies (versioning + attestation campaigns), evidence, AI-system registry, framework delta, SOX, ESG, trust center, reports (incl. board pack), audit copilot — all modules ✓ ✓ ✓ One platform-wide gate: require_active_license on every GRC router. No per-framework flags exist in the code; the only module-level gates are require_feature("a2a") (granted in every edition) and require_cloud_tier (off on air-gap keys by design) — both listed below.
Compliance frameworksAll 20, 2,082 controls: NIST SP 800-53 Rev. 5 (1,014), NIST SP 800-171 Rev. 2 (110), CMMC L1/L2/L3 (15/110/24), CCPA/CPRA (107), NIST CSF 2.0 (106), ISO/IEC 27001:2022 (93), TISAX (80), DORA (64), PCI DSS v4.0.1 (63), NIS2 (63), SOC 2 Type II (61), ISO/IEC 42001:2023 (38), GDPR (30), HIPAA (25), NYDFS Part 500 (25), EU AI Act (19), NIST AI RMF (19), GLBA (16) All All All Not gated per framework — every licensed install gets every framework. That is the “no framework tax”.
Seats (active users, install-wide) 5 25default; set at purchase 100+custom require_seats_available on user create, user invite, and invitation accept — returns 403 seat_limit_exceeded past the seat count signed into the key.
License term Rolling 90 daysauto-refreshes every backend restart — never a hard cliff 1 year Custom Ed25519-signed exp claim, re-checked in real time. Expired key → 403 license_required; data untouched.
A2A vendor attestation ✓ ✓ ✓ require_feature("a2a") on the A2A router. Community grants it via the a2a entitlement; paid keys via the feats list.
Cloud data-source connectionsAWS / Azure evidence collectors ✓ ✓ ✓off on air-gap keys, by design require_cloud_tier on the connections router — air-gap (tier1) licenses get 403 because an offline deployment has no business calling cloud APIs.
Air-gap deployment tierOffline validation, local vLLM, no cloud dependencies — — ✓ License tier claim (tier1). Signature validation is fully offline — the product never phones home to check a license.
Offline license validationNo phone-home, no license server dependency ✓ ✓ ✓ Ed25519 signature verified against a local public key; clock-tamper protection via a persisted high-water mark.
Bring your own LLMNVIDIA NIM, Cloudflare Workers AI, or any OpenAI-compatible endpoint (vLLM, Ollama, …) — configurable from the admin UI with a connection test — or none, for Rego-only ✓ ✓ ✓ Configuration, not a license gate. AI features depend on the key you connect, not the tier you pay for.

The honest fine print

Community is not crippleware

The free tier runs the same code as paid tiers — same modules, same frameworks, same A2A protocol. The only differences are the 5-seat limit and the license mechanics. Its rolling 90-day license refreshes automatically on every backend restart, so a self-host install never expires out from under you.

Some license flags exist but are not yet enforced

Signed keys carry sso, bedrock, vllm, and govcloud entitlement flags for forward compatibility, but no API endpoint currently checks them — so we will not sell them to you as gates. SSO (via auth modes) and your choice of LLM provider work in every edition today. If we ever start enforcing one of these flags, this page changes first.

What happens when a paid license expires

The API returns 403 license_required on GRC endpoints. Nothing is deleted, no data is exported or held hostage, and login/setup still work so you can paste a new key. Your database and object storage are yours; a self-host install can also fall back to the free Community Edition.

Where the trial fits

The 30-day trial key (5 seats, signed, cloud tier) exists mainly for evaluating the signed-key flow before a purchase. If you are self-hosting with AUTH_MODE=local, you do not need it — Community Edition activates on its own with the same feature set.

Start free. Upgrade only for seats.

Install the free Community Edition in minutes, or talk to us about a Professional or Enterprise key. Still evaluating? Read how GRCFlow compares to SaaS and legacy GRC platforms, or start at the GRCFlow platform overview.

Install Community — Free Get a 30-Day Trial Key Contact Sales