Pricing
One price. No sales call.
Flat, per organization, every feature. No seat counts to forecast, no tier that hides the feature you need, and nothing you have to book a demo to find out.
- Every feature, no tiers
- Unlimited people
- ISO 27001, ISO 42001 and ISO 9001 included, NIS2 mapped, CRA reporting inside
- Hosted in the EU
- No minimum term
- Support included: email, answered within one business day by the people who build the product
What is in the subscription
One price, every feature. Under it, what is sold separately.
Monthly
€249/mo
per organization, excl. VAT
- Month to month, renews until you cancel
- Cancel in the app, effective at the end of the month
- 14-day free trial, no card
| What is in it | Included |
|---|---|
| Management system | |
| ISO 27001, ISO 42001 and ISO 9001, on the same terms | Included |
| A Statement of Applicability with drafted justifications | Included |
| A risk register with treatments | Included |
| Internal audit and management review records | Included |
| The certified year on Today: what is due, when | Included |
| Evidence | |
| Evidence collected as it happens, dated, on a tamper-evident chain | Included |
| One-click export of every record, in open formats | Included |
| An auditor role that can read every record and change none | Included |
| Regulations | |
| CRA reporting: Article 14 events with the ENISA fields, and the 24-hour, 72-hour and 14-day clocks | Included |
| NIS2: the measures, the registration and the incident clocks | Included |
| DORA: the register of information, the contract clauses and the incident clocks | Included |
| GDPR: the record of processing, the breach clock and the request clock | Included |
| AI Act: the classification, the obligations and the Article 50 dates | Included |
| Data Act: the obligations by role and the three dates | Included |
| The determination tools on this site, free without an account | Free, no account |
| Integrations and checks | |
| Read-only integrations: GitHub, identity providers, cloud accounts, Snyk, device management | Included |
| Automated checks that write evidence on a schedule | Included |
| A digest naming what is overdue and who owns it | Included |
| People and access | |
| Unlimited people, no per-seat charge | Included |
| SAML 2.0 single sign-on and an enforceable second factor | Included |
| Owner, admin, member and auditor roles | Included |
| A trust page of your own for customers, with an NDA gate if you want one | Included |
| In every subscription | |
| Every feature, no tiers | Included |
| One organization per subscription | Included |
| Hosted in the EU | Included |
| Support by email, answered within one business day | Included |
Not included: The text of the standard, sold by ISO and national standards bodies · Penetration tests, or anything an auditor asks you to procure · The certification body's audit fees · Consultancy
Prices in euro, excluding VAT. Paddle takes the payment and adds or reverse-charges the VAT for your country.
Add when you need it
One purchase for one situation; the download packs need no subscription.
- Now in force . Reporting duties apply since 11 Sept 2026.
You make a product with digital elements
CRA technical file
List price €3,000
€2,000
33 % off the list price, introductory, until 31 October 2026once, per product, excl. VAT
CRA file, one product
Bought once; 11 controlled documents drafted into your organization
Documents by email; add them to a free workspace whenever you like.
See the pack, €2,000 - Now in force . Reporting duties apply since 11 Sept 2026.
You import or distribute one
CRA importer and distributor pack
List price €1,800
€1,200
33 % off the list price, introductory, until 31 October 2026once, per organization, excl. VAT
CRA, importers and distributors
Bought once; 7 controlled documents drafted into your organization
Documents by email; add them to a free workspace whenever you like.
See the pack, €1,200 You place a machine on the market
Machinery Regulation technical file
List price €3,000
€2,000
33 % off the list price, introductory, until 31 October 2026once, per machine, excl. VAT
Machinery file, one machine
Bought once; 7 controlled documents drafted into your organization
Documents by email; add them to a free workspace whenever you like.
See the pack, €2,000- Now in force . Reporting duties apply since 11 Sept 2026.
You want the CRA work offline, without the system
CRA Readiness Toolkit
€199
once, per organization, excl. VAT
Offline: file, registers, runbook
Bought once; downloaded as files, yours to keep
A bank or insurer sends you the DORA questionnaire
DORA Vendor Pack
€199
once, per organization, excl. VAT
Offline: clauses, register, due diligence
Bought once; downloaded as files, yours to keep
You must register as an essential or important entity
NIS2 Registration Pack
€199
once, per organization, excl. VAT
Offline: worksheet, registration, runbook
Bought once; downloaded as files, yours to keep
What the price does not cover
Certification has costs beyond software, and a pricing page that hides them is setting up an unpleasant conversation later. Here is the whole list.
- The certification audit itself
- Paid to an accredited certification body, not to us. It is the larger number, and it is not optional, because a certificate comes from them. What the audit costs
- A copy of ISO/IEC 27001
- The standard is copyrighted and sold by ISO and by national standards bodies, whichever one serves your country. You do not strictly need a copy to use StandardOS, but you will want one.
- Consultancy
- We do not sell hours, and there is no implementation package to buy. The product drafts the documents; the judgement stays yours, or your consultant's. What no consultant can do is stay, and the years after the engagement are what the product is built for. Invite one in if you want; the records stay yours.
- Penetration tests, or anything an auditor asks you to procure
- Some controls are satisfied by evidence you buy elsewhere. StandardOS tracks that the evidence exists and when it expires; it does not produce it.
Billing, plainly
- When am I charged?
- Never during the 14-day trial, and not without a card you entered yourself. When the trial ends the workspace becomes read-only. It is not deleted, and you can still sign in, read everything and export it all.
- Is VAT included?
- No. €249 is excluding VAT, which is how B2B prices are quoted across the EU. VAT is added at checkout according to your country and whether you supply a valid VAT number. With a valid number the reverse charge usually applies and we add none.
- What if we get stuck?
- Email us. Support is included in the price and answered within one business day by the people who build the product, not a tiered help desk. Every screen explains what the clause behind it asks for, and when that is not enough, a person who knows the product answers. What you are not buying is a dependency: the system lives in the product and in your records, not in one person's head.
- What if we grow?
- Nothing changes. The price is per organization, not per seat, and there is no tier to move up to. A company of 8 and a company of 80 pay the same.
- How do I cancel?
- In the app, without emailing anyone. There is no minimum term and no notice period. Cancelling stops the next charge and leaves your data readable and exportable.
What you get for it, stated precisely
ISO 27001 has 26 requirement clauses. StandardOS covers 26 of them in full, and the register says, clause by clause and before you pay, where the product does less than you might assume.
Compared with Vanta, Drata, Cyberday, Secureframe, a consultant and spreadsheets
Related:What compliance software costsMarketplaceWhat certification costs
Try it before you decide
14 days, no card, and your Statement of Applicability is generated in the first fifteen minutes, so you find out whether this works for you well before there is anything to pay.