Pricing
Priced to what you govern.Not to who logs in.
Choose from more than 40 modules across five domains. You pay for the modules you deploy, the entities and jurisdictions they cover, and where the platform runs — on-premises, in a private cloud or on Microsoft Azure and Google Cloud.
Start with one workflow. Add the next without rebuilding anything.
- Modules
- From 40+ across 5 domains
- Entities and jurisdictions
- Banded
- Deployment
- On-prem · Private · Cloud
- Implementation
- One-off, scoped to you
- Users
- Unlimited, always
- AI capabilities
- Included, never metered
How it works
How SustainGRC is priced
An annual subscription priced by governed scope, not by user — plus a one-off implementation fee for the modules you start with. Users are unlimited and AI usage is never metered.
- 01
Modules you deploy
From more than 40 across five domains.
- 02
Entities and jurisdictions
The legal entities and reporting jurisdictions you govern.
- 03
Where it runs
On-premises, private cloud, or managed on Microsoft Azure or Google Cloud.
- Your price
Annual subscription
+ a one-off implementation fee for the modules you start with.
- × usersUnlimited
- × AI usageNever metered
Why no list price? Two companies deploying the same modules rarely govern the same scope. Scope your platform below and we will email you an indicative range — a planning figure, not a quotation. A scoping call then turns it into an itemised proposal, with each module, scope band and deployment option priced separately.
Included
The governed core, in every subscription
The foundation, not an upsell. It is the same whichever modules you choose and wherever you run them.
Scope builder
Scope your platform
Three steps, about two minutes. Then we email you an indicative range for your scope.
Deployment
Deploy where your data needs to live
Choose the option your regulator and security team expect. On-premises is fully supported, not an exception.
- Same platform
- Same governed core
- Same modules
Under your infrastructure and security controls
One line on your proposal
Same platform, same governed core, same modules on every option. Your choice of deployment is one line on your proposal, not a different product.
Unlimited users
Why we do not price by user
Governance evidence comes from the edges: the control owner who attests once a quarter, the risk owner who updates one register, the board member who signs off a decision.
Per-user pricing turns each of them into a licence question, and companies end up rationing access to the people whose sign-off the record depends on. We price the scope you govern instead. The first line, second line, internal audit and the board work on the same record, and adding a contributor never changes your bill. As more routine work is assisted by AI, your price stays tied to what you govern, not to how many people it takes.
- Control owner+1 licence
Every contributor is a licence question.
- Modules
- Entities and jurisdictions
- Deployment
- UsersUnlimited
Adding a contributor never changes your bill.
Buying process
From scope to start
- Unlimited users
- No charge to add participants
- AI capabilities included
- No migration to add a module
Scope
Use the builder for an indicative range, or book a 30-minute scoping call. No obligation, no slides.
Proposal
Itemised by module, scope band and deployment option, so every line is visible.
Start
Go live on one workflow first. We agree the first evidence milestone with you at signing.
Grow
Add a module or domain as a governed addition to the same record. Nothing approved is re-entered or overwritten.
Everything procurement will ask for
One concise pack for security, vendor onboarding and procurement reviews — so your team is not chasing answers.
What the pack covers
- 01Company and credentialsRegistered details, ownership and contacts
- 02Cyber Essentials PlusIndependently certified
- 03GRI Licensed Software PartnerLicensed for GRI reporting
- 04Deployment and hostingOn-premises, private cloud, Azure and Google Cloud
- 05Platform controlsAudit trail, separation of duties, access
- 06Governed AIHuman review and provenance on every suggestion
- 07Documents on requestSecurity questionnaire, DPA and more
Build the internal case
The ROI calculator models the cost of fragmented governance and the value of running it on one record, using assumptions you can edit. The Three Lines Check is ten questions for risk, audit and security leaders — answer separately, compare views and see where to start. About three minutes, no sign-up to start.
The SustainGRC Impact Programme
The full platform on eligibility-based terms for non-profits, development and humanitarian bodies, social enterprises, and companies in emerging markets building governance for the first time. Reviewed individually.
Apply to the Impact ProgrammeFAQ
Pricing questions, answered.
Can’t find what you need? Our team will walk you through it.
Last updated
SustainGRC is governance intelligence infrastructure: one platform and one data model across five domains — Sustainability; Integrated Risk, Audit & Compliance; Board Governance; AI Governance; and Cyber & Resilience — with more than 40 modules.
SustainGRC is an annual subscription priced by governed scope: the modules you deploy, the legal entities and jurisdictions you govern, and where the platform runs, plus a one-off implementation fee for the modules you start with. There are no per-user fees. Use the scope builder on this page to receive an indicative range by email, then a scoping call turns it into an itemised proposal.
No. The indicative range helps you plan and build an internal case. It is not an offer or a quotation. Your formal proposal follows a scoping call and prices each module, scope band and deployment option separately.
Two companies deploying the same modules rarely govern the same scope. A list price would be wrong for almost everyone who read it, so we give you a range based on your own scope and then an itemised proposal, with each element priced separately so you can see what drives the total.
No. User numbers are not a pricing input. Users are unlimited on every subscription, so everyone who contributes evidence, reviews or approves is included and you never ration access to the people your governance record depends on.
They do not. AI capabilities are part of the platform in every subscription. They are not metered, sold as credits or charged per use. Every AI suggestion is reviewed before it counts, and its provenance is kept on the record.
By module. SustainGRC has more than 40 modules across five domains, and you subscribe to the modules you need. You can start with a single module and add the next as a governed addition to the same record.
Yes. You can start with one workflow, then add modules and domains without migration or re-entry. Nothing you have already approved is re-entered or overwritten.
The governed core: a single evidence store, data quality and lineage, an immutable audit trail, database-enforced separation of duties, framework mapping, governed AI, unlimited users with dashboards and a collaboration feed, and the SustainGRC Academy. Implementation is a one-off fee, scoped separately.
Yes. SustainGRC can be installed on-premises in your own data centre, deployed in a private cloud, or run as a managed cloud service. Every option runs the same platform and the same governed core.
Microsoft Azure and Google Cloud, either as a managed service or in your own tenancy, as well as your own private cloud. In-country hosting is available where data residency requires it.
Framework coverage spans sustainability, risk and audit, AI, data protection, cyber and resilience — including ISSB, CSRD, GRI, the GHG Protocol, IIA GIAS 2024, COSO, ISO 31000, ISO/IEC 27001:2022, NIST CSF 2.0, DORA, NIS2, ISO 22301, ISO/IEC 42001, the EU AI Act and GDPR. Evidence captured once maps to every framework it applies to.
Yes. SustainGRC serves companies globally, with on-premises, private cloud and managed cloud options that meet local data-residency requirements, and framework coverage for international and national regimes.
A multi-tool stack licenses each function separately and reconciles evidence between them. On SustainGRC every domain shares one data model, so evidence attached once supports every framework it applies to, and one subscription covers what you govern rather than a licence count per tool.
You go live on one workflow first, and we agree the first evidence milestone with you at signing, so the timetable is set by your scope rather than by a standard programme.
SustainGRC is certified to Cyber Essentials Plus and is a GRI Licensed Software Partner. Security, AI and data-processing information is available in the procurement pack.
Yes. The ROI calculator models the value of running your governance on one record using assumptions you can edit, and the Three Lines Check shows in about three minutes how well risk, audit and security work together.
Yes, through the SustainGRC Impact Programme, which offers the full platform on eligibility-based terms. Applications are reviewed individually.
Confirm once.Prove it anywhere.
Not ready for a demo? Take the Three Lines Check →