Managed GRC · From $3,500 a month

Your compliance operation, run for you.

The platform is the system of record. The real work lives in the connectors, evidence, policy checks and privacy operations around it. We run that work month to month on Drata, Vanta or Secureframe, so the audit happens on schedule instead of as a yearly scramble.

Essentials Professional Build Compare

Two tiers

Essentials for one framework. Professional for more.

ESSENTIALS

From $3,500 / month

Your compliance operations manager. One framework on one platform, typically under 100 staff. Readiness runs inside the retainer, so there is no separate readiness project.

Framework scoping and control mapping (SOC 2, ISO 27001, HIPAA)
Platform setup or takeover on Drata, Vanta or Secureframe, native integrations connected
Policy set drafted, approved and reviewed yearly
Monthly evidence and owner follow up
Risk register, access reviews, training tracking
Audit prep and liaison with your auditor
Trust Center and a questionnaire allotment
IR and continuity plans with an annual tabletop

Moves the price: over 100 staff or a second framework. Fixed once scoped.

PROFESSIONAL

From $6,000 / month

For more frameworks and a heavier audit load. Two or more frameworks, or one framework with customer and partner audits on top.

Everything in Essentials
Two or more frameworks run from one control set, such as SOC 2 with HIPAA
Full audit support: walkthroughs, evidence sampling and population pulls
Findings negotiated and management responses written before the draft report
Customer and due diligence audits managed
Vendor risk program set up and run
Larger questionnaire allotment with a turnaround commitment
Weekly status with budget burn

Moves the price: a third framework, headcount, or more than two customer audits a year. HITRUST r2, FedRAMP and enterprise GRC tools scoped separately.

vGRC Build · Fixed build fee, then your monthly tier

Your platform is the system of record. We build the plumbing.

Platforms automate less than half of what an audit requires. Build connects your platform to your cloud, identity, code, HR, data stores and vendors so evidence, controls and privacy obligations run continuously. For Series B and later or PE backed companies with sensitive data or AI features.

Cloud and infrastructure

Posture mapped to controls. Infrastructure as code checked before it ships.

Identity

Access reviews generated from your identity provider. Joiner, mover, leaver checks automated.

Code and CI/CD

SDLC evidence from the pipeline. Policy checks run where the work happens.

Evidence repo you own

Scheduled collectors pull evidence, hashed and timestamped, into a repo in your GitHub. Portable, with no lock-in to one platform.

Privacy engineering

Data map, retention and deletion down to verification. Requests you can prove, not just promise.

Drift alerts

When a control drifts, an owner and an SLA are attached. An AI use inventory for ISO 42001.

Scoped after a Platform Health Check. Converts to Essentials or Professional at go live, so everything keeps running. Audits with almost no manual evidence.

Compare

What changes from tier to tier.

Compare	Essentials	Professional	Build	vCISO →
Role	Compliance ops manager	More frameworks and audits	Builds the plumbing	Senior security leader
Price	From $3,500 / mo	From $6,000 / mo	Fixed build fee	From $10,000 / mo
Frameworks	One	Up to two	Any, built once	Program wide
Evidence	Platform plus manual	Platform plus manual	Automated, in your repo	Through the GRC tier
Audits	Prep and liaison	Findings and customer audits	Minimal manual evidence	Owns audit strategy
Reporting	Monthly ops report	Weekly status, budget burn	Build milestones	KPI pack, CFO view, board
Budget ownership	No	No	No	Yes