Five plans. One GRC platform.
grComply comes in five plans. Starter, Professional and Enterprise Cloud run in the cloud; Enterprise and Enterprise Assured run hybrid or fully on-premises for organisations whose compliance data must stay in-house. Every plan carries the same compliance core — frameworks, cross-framework control mapping, evidence, risk, scanning and audit delivery. Plans differ in capacity, hosting, security posture depth and the support around you. Plans start at £1,200 per month.
Quoted per organisation in GBP or USD, based on plan, size band and deployment. Contact us for a demo, a proof of concept or a written quote.
Starter
For mid-market organisations running one compliance programme.
Cloud (UK/EU)Professional
For growing organisations with several programmes and more frequent scanning.
Cloud (UK/EU)Enterprise Cloud
For large organisations happy with cloud hosting, including in-country locations.
Cloud — UK/EU or in-countryEnterprise
For banks, telecoms and government — compliance data stays on your premises.
Hybrid or on-premisesEnterprise Assured
The platform and the outcome: implementation, 24/7 support and quarterly reviews.
Hybrid or on-premises, run with MutexgrComply plans by customer type and industry
Each plan suits a different kind of organisation. Start from where your compliance data must live and how many frameworks you run; your industry usually settles the rest.
| Plan | Type of customer | Industry verticals | Typical frameworks |
|---|---|---|---|
| StarterCloud (UK/EU) | Mid-market organisations running one compliance programme with a small compliance team — up to 200 platform users. | SaaS and technology, fintech start-ups, professional services, digital agencies, mid-market manufacturing. | ISO 27001, SOC 2, Cyber Essentials, UK GDPR |
| ProfessionalCloud (UK/EU) | Growing organisations running several frameworks in parallel, scanning more often and training the wider workforce — up to 500 platform users. | Scale-up SaaS and fintech, payments and e-commerce, healthcare and life sciences, logistics, audit and consultancy firms. | ISO 27001 with SOC 2 and GDPR, PCI DSS, HIPAA, ISO 27017 and 27018 |
| Enterprise CloudCloud — UK/EU or in-country | Large organisations content with cloud hosting that need unlimited frameworks, full security posture management, seven-year history or in-country data residency. | Insurance, retail groups, higher education, healthcare networks, regional banks and fintechs under data-residency rules. | DORA, NIS2, NIST CSF, CIS Controls, ISO/IEC 42001, sector regulator frameworks |
| EnterpriseHybrid or on-premises, air-gapped option | Regulated organisations whose compliance data must stay on their own infrastructure, with in-house IT to run the platform. | Banking and financial services, telecoms, government and public sector, energy and utilities, critical national infrastructure, defence supply chain. | DORA, central-bank and telecom-regulator frameworks, ISA/IEC 62443, MITRE ATT&CK, national cyber security frameworks |
| Enterprise AssuredHybrid or on-premises, run with Mutex Systems | Organisations that want the platform and the outcome — implementation, 24/7 support, quarterly compliance reviews and an awareness roll-out — without a large in-house GRC team. | Regulators and national CERTs, state-owned enterprises, banks preparing for regulatory inspection, telecom operators, large public bodies. | Regulator-mandated national frameworks alongside ISO 27001 and sector standards |
Every grComply feature, plan by plan
Features run down the rows and plans across the columns. ✓ means included; — means not part of that plan.
| Feature | CloudStarter | CloudProfessional | CloudEnterprise Cloud | Private and hybridEnterprise | Private and hybridEnterprise Assured |
|---|---|---|---|---|---|
| Hosting and deployment | |||||
| Where grComply runs | Cloud (UK/EU) | Cloud (UK/EU) | Cloud — UK/EU or in-country | Hybrid or on-premises | Hybrid or on-premises, run with Mutex |
| Air-gapped option | — | — | — | ✓ | ✓ |
| Hybrid sync controlsChoose exactly which summaries leave your estate | — | — | — | ✓ | ✓ |
| Size bandsBase, Large and Very large — by users, assets and sites | — | — | ✓ | ✓ | ✓ |
| Capacity | |||||
| Platform usersLarger organisations move up a size band | 200 | 500 | 1,000+ | 1,000+ | 1,000+ |
| Compliance frameworks | 50 | 100 | Unlimited | Unlimited | Unlimited |
| Evidence storage | 100 GB | 250 GB | 1 TB | Your own storage | Your own storage |
| Evidence items | 50,000 | 100,000 | 250,000 | Unlimited | Unlimited |
| Exports per month | 100 | 250 | 1,000 | Unlimited | Unlimited |
| Audit history kept | 1 year | 2 years | 7 years | 7 years | 7 years |
| Governance and compliance | |||||
| Framework and control libraryInternational standards and regional regulations; new frameworks load as data | ✓ | ✓ | ✓ | ✓ | ✓ |
| Cross-framework control mappingMap once, cover many — with a coverage matrix | ✓ | ✓ | ✓ | ✓ | ✓ |
| Evidence managementUpload, approve, version and expire evidence against controls | ✓ | ✓ | ✓ | ✓ | ✓ |
| Control narratives and not-applicable decisions | ✓ | ✓ | ✓ | ✓ | ✓ |
| Policy managementDraft, review, approve and publish policies | ✓ | ✓ | ✓ | ✓ | ✓ |
| Obligations and regulatory change tracking | ✓ | ✓ | ✓ | ✓ | ✓ |
| Continuous compliance dashboardsLive readiness by framework, control and owner | ✓ | ✓ | ✓ | ✓ | ✓ |
| Risk and privacy | |||||
| Risk registerYour own scoring methodology, appetite line and heat map | ✓ | ✓ | ✓ | ✓ | ✓ |
| Findings turned into risks | ✓ | ✓ | ✓ | ✓ | ✓ |
| Data protection impact assessments (DPIAs) | ✓ | ✓ | ✓ | ✓ | ✓ |
| AI system governance register | ✓ | ✓ | ✓ | ✓ | ✓ |
| Security posture | |||||
| Vulnerability scanningExternal checks and internal agent scans | ✓ | ✓ | ✓ | ✓ | ✓ |
| Findings triage linked to controls and assets | ✓ | ✓ | ✓ | ✓ | ✓ |
| Scheduled scans | 5 | 10 | 25 | 50 | 50 |
| Most frequent scan | Once a day | Every 6 hours | Every 4 hours | Once an hour | Once an hour |
| Full security posture managementAsset inventory with named owners, device checks, configuration baselines and code scanning in one view | — | — | ✓ | ✓ | ✓ |
| Audit and reporting | |||||
| Auditor engagements and observationsRaise, respond, countersign and close with a full timeline | ✓ | ✓ | ✓ | ✓ | ✓ |
| Executive dashboard and board reporting | ✓ | ✓ | ✓ | ✓ | ✓ |
| Scheduled reports and export packages | ✓ | ✓ | ✓ | ✓ | ✓ |
| Tamper-evident audit trail | ✓ | ✓ | ✓ | ✓ | ✓ |
| AI and people | |||||
| AI assistant and policy searchAnswers cite their sources; a person always confirms | Included (fair use) | Included (fair use) | Included (fair use) | Included | Included |
| Private AI model option | — | — | — | ✓ | ✓ |
| Security awareness training and phishing simulation | — | Add-on seats | Add-on seats | Add-on seats | Included up to size band |
| Role-based workspacesAdministrators, compliance officers, executives, auditors and reviewers | ✓ | ✓ | ✓ | ✓ | ✓ |
| Service and support | |||||
| Implementation | Self-service | Self-service | Remote onboarding included | Available separately | Included |
| Support | Product specialist, next working day | Product specialist, next working day | Business-hours service levels | 24/7 for critical issues | 24/7 with a named customer success manager |
| Quarterly compliance reviews | — | — | — | — | ✓ |
Not sure which plan fits? Book a demo and a product specialist will map your frameworks and deployment to the right plan.
Common questions about grComply plans
Which grComply plan do I need?
Choose by where your data must live and how large your programme is. Starter and Professional run in Mutex-managed UK/EU cloud; Enterprise Cloud adds in-country hosting and onboarding. Enterprise runs hybrid or fully on-premises, and Enterprise Assured adds implementation, 24/7 support and quarterly compliance reviews.
Which grComply plan suits banks, telecoms and government?
Enterprise or Enterprise Assured. Both run hybrid or fully on-premises with an air-gapped option, so compliance data stays on your infrastructure. Enterprise Assured adds implementation, 24/7 support with a named customer success manager, quarterly compliance reviews and an awareness roll-out.
Can grComply run on-premises or air-gapped?
Yes. The Enterprise and Enterprise Assured plans run grComply in hybrid mode or fully on-premises, including an air-gapped option, so sensitive compliance data never has to leave your estate. Licences activate and renew without opening inbound access to your network.
Is every grComply feature available on every plan?
The compliance core — frameworks, cross-framework mapping, evidence, policies, obligations, risk, DPIAs, scanning, audit delivery, reporting and the AI assistant — is on every plan. Larger plans add capacity, more frequent scanning, full security posture management, in-country or on-premises hosting and more support.
Is security awareness training included?
Security awareness training and phishing simulation are available as add-on seats on Professional, Enterprise Cloud and Enterprise, and are included up to your size band on Enterprise Assured. Training seats are separate from your platform users, so the whole workforce can learn without platform licences.
How do I see a demo of grComply?
Contact us or book a 30-minute demo below. A product specialist walks you through a working grComply workspace — controls, evidence, risk, scanning and audit delivery — and then on to the plan and deployment that fit your frameworks.
Can we run a proof of concept before choosing a plan?
Yes. Contact us and a product specialist scopes a proof of concept on your own frameworks and systems, so your team sees grComply working with real controls, evidence and scan results before you commit to a plan.
How is grComply priced?
grComply plans start at £1,200 per month. Each organisation receives a written quote in GBP or USD based on its plan, size band (users, assets and sites) and deployment model. Contact us for a demo, a proof of concept or pricing.
See grComply on your own frameworks
Book a demoPowered by Mutex Systems. Back to grComply overview → · grComply vs GRC platforms →
Talk to us about the right grComply plan
Tell us about your frameworks and deployment posture — cloud, hybrid, or private on-prem — and we'll route it to the right product specialist.
- A product specialist replies personally — not a bot
- No obligation after the first conversation
- WhatsApp support also available 24/7
By submitting, you agree to be contacted about your enquiry. We respect your privacy.
Book a meeting directly
Pick a time that works for you — 30 minutes with a product specialist, no sales script.
Ready to see grComply?
We respond within one working day — or reach us instantly on WhatsApp.