Pricing
Start a free trial without payment details.
Create a workspace, adopt a framework, link real evidence. No credit card. Verify by email within 7 days; we suspend if you don't.
Single company. Up to two frameworks.
€99 /month
€949 /year Save 20%
Multi-framework, AI ingest, integrations.
€299 /month
€2690 /year Save 25%
Large organizations or vCISO portfolios
From €499 /month
From €5988 /year Save 15%
| Capability | Starter | Growth | Consultancy |
|---|---|---|---|
| Framework programs | |||
| Active framework programs | Up to 2 | Unlimited | Unlimited (per client) |
| Seeded framework catalogue (GDPR, NIS2, DORA, ISO 27001, SOC 2, EU AI Act, MiCA, HIPAA, EU CRA, ISO 27005, ISAE 3402, PCI DSS, CER) | ✓ | ✓ | ✓ |
| Cross-framework crosswalks (matching requirements of your other frameworks suggested from what you already meet) | ✓ | ✓ | ✓ |
| Custom framework authoring (YAML upload, in-app builder, AI-drafted) | – | ✓ | ✓ |
| Share custom frameworks with client tenants (selectively) | – | – | ✓ |
| Fasttrack guided start (frameworks, policies, controls, registers, task plan) | ✓ | ✓ | ✓ |
| Fasttrack presets for new client workspaces | – | – | ✓ |
| New framework requirements added to running programs when you choose | ✓ | ✓ | ✓ |
| Users and tenancy | |||
| Users | Up to 25 | Up to 100 | Unlimited across all client tenants |
| Managed client workspaces | – | – | At least 1 master + 5 managed workspaces; upgrade for more |
| Cross-client tenant switcher + portfolio-wide reporting | – | – | ✓ |
| Strict per-client tenant isolation (RLS on every table) | N/A | N/A | ✓ |
| Compliance surface | |||
| Policy lifecycle (draft, review, approve, publish, versioning, acknowledgements) | ✓ | ✓ | ✓ |
| Procedures and standards (full policy hierarchy) | ✓ | ✓ | ✓ |
| Evidence library + risk register + tasks | ✓ | ✓ | ✓ |
| GDPR registers: RoPA, DPIA, breach register, DSAR intake | ✓ | ✓ | ✓ |
| DORA registers: ICT third-party (Art. 28), continuity plans, drill logs | ✓ | ✓ | ✓ |
| Vendor register with tiers and review dates, and scored due-diligence questionnaires (general, DORA, NIS2 or your own) | ✓ | ✓ | ✓ |
| Asset inventory | ✓ | ✓ | ✓ |
| Coverage donuts, per-domain heatmaps, per-requirement drill-downs | ✓ | ✓ | ✓ |
| Control library with test plans and results | ✓ | ✓ | ✓ |
| Statement of Applicability (PDF and Excel) | ✓ | ✓ | ✓ |
| Incident register with GDPR, NIS2 and DORA reporting deadlines | ✓ | ✓ | ✓ |
| Risk appetite, scheduled risk reviews and formal risk acceptance | ✓ | ✓ | ✓ |
| Policy exceptions with approval and an end date | ✓ | ✓ | ✓ |
| Training and people | |||
| Employee security training module (courses, assignments, acknowledgements, reminders) | ✓ | ✓ | ✓ |
| Per-role and per-user assignment with completion tracking | ✓ | ✓ | ✓ |
| Calendar and reminders | |||
| Governance calendar (timeline, agenda, year plan, recurring activities) | ✓ | ✓ | ✓ |
| Email reminders and a daily digest | ✓ | ✓ | ✓ |
| Calendar feed for Outlook and Google Calendar | ✓ | ✓ | ✓ |
| One calendar across client workspaces | – | – | ✓ |
| Continuity and resilience | |||
| Business continuity plans + DR drills with drill logs | ✓ | ✓ | ✓ |
| Reporting and exports | |||
| Full exportable reports (PDF and XLSX) | ✓ | ✓ | ✓ |
| Portability report (PDF and XLSX) | ✓ | ✓ | ✓ |
| Scheduled recurring reports | – | ✓ | ✓ |
| Board pack and scores profile | ✓ | ✓ | ✓ |
| Integrations and data sources | |||
| Full support for integrations and data sources (S3, Azure Blob, GCS, SharePoint, Confluence, ADO Wiki, Jira, ServiceNow) | ✓ | ✓ | ✓ |
| Cloud posture sync (AWS / Azure / GCP) | – | ✓ | ✓ |
| AI | |||
| AI evidence ingest (proposals from connected sources) | – | ✓ | ✓ |
| AI-drafted custom frameworks from pasted regulation text | – | ✓ | ✓ |
| AI assistant grounded in tenant data (Ask Atitic) | – | ✓ | ✓ |
| AI connections (MCP): your own AI assistant reads your compliance data, read-only, per person | – | ✓ | ✓ |
| Branding and identity | |||
| Custom branding (logo, colors, favicons) | ✓ | ✓ | ✓ |
| Per-client branding + full isolation | – | – | ✓ |
| Custom subdomain | ✓ | ✓ | ✓ |
| Custom domain (your own hostname) | – | ✓ | ✓ |
| Branded transactional email (DKIM under your domain) | – | ✓ | ✓ |
| Identity and access | |||
| Single sign-on (OIDC and SAML 2.0) | ✓ | ✓ | ✓ |
| SCIM 2.0 automated user provisioning | – | ✓ | ✓ |
| Multi-factor authentication (TOTP) | ✓ | ✓ | ✓ |
| Role-based access control (per-module read / manage / approve) | ✓ | ✓ | ✓ |
| Audit and legal | |||
| Tamper-evident audit log on every mutation | ✓ | ✓ | ✓ |
| Personalized Terms of Service, Privacy Policy, and DPA per tenant, per language | ✓ | ✓ | ✓ |
| Audit request lists and external auditor access limited to one audit | ✓ | ✓ | ✓ |
| Evidence packs (ZIP with an index of every file) | ✓ | ✓ | ✓ |
| Evidence versions, SHA-256 fingerprint and reviewer sign-off | ✓ | ✓ | ✓ |
| Hosting and support | |||
| EU-hosted data (Postgres + object storage in EU regions) | ✓ | ✓ | ✓ |
| Email support | Standard | Priority | Priority + dedicated onboarding |
No. The 14-day trial requires only a working email. Verify within 7 days or the workspace is suspended.
In the EU: the database and stored files are in EU regions. AI features are off until a company turns them on and accepts the AI addendum, and the company chooses which kinds of records Ask Atitic may read. When they are on, the AI provider may process the request outside the EU; everything else works with them off.
Yes – upgrade or downgrade at any time. We pro-rate on the next invoice.
Any active login in a company workspace. External auditors you invite for an audit do not take a seat, and consultancies have no seat limit.
Yes, up to 30 days.
Reach out – we'd rather answer the question than have you guess.
Talk to us