Pricing
One price. No sales call.
Flat, per organization, every feature. No seat counts to forecast, no tier that hides the feature you need, and nothing you have to book a demo to find out.
€249 /mo
excl. VAT, per organization
Start your compliance systemNo card to start · cancel in-app anytime
Want us to set it up with you?
Free during the trial. One 60-minute call with us. Within 5 working days after it, your frameworks are chosen and your company facts entered. Your integrations are connected where you give access, and your first policies are drafted for you to approve.
Reply to your welcome email and we will agree a time.
- Every feature, no tiers
- Unlimited people
- ISO 27001, ISO 42001, ISO 9001, ISO 27701 and ISO 14001 included, NIS2 mapped, CRA reporting inside
- Hosted in the EU
- No minimum term
- Support included: email, answered by us within one business day
What it does
Everything a program needs, already wired together
Know what applies, in writing
Answer a few questions. Get each rule's verdict with the article it rests on.
Evidence every morning
Read from your tools, tied to the control it proves.
Every clock, counted
The deadlines that matter to you, nobody else's.
Policies people sign
Drafted for your company, approved with a name and a date.
With you at each step
From the scope to the auditor, in one subscription
1 The scope
The scope statement, written from your answers.
2 The policies
Drafted from your answers, approved and kept current.
3 The evidence
Read every day from the tools you already run.
4 The audit
The Statement of Applicability and the audit pack, ready on the day.
5 The auditor
Your auditor reads every record and changes none, from a start date to an end date.
Eight things, checked
What only StandardOS does, checked against their pages
CRA technical file generated from the product record
Yes: the Annex VII file, eleven documents, written from the product's record and kept as it changes; on the site as a writer, in the product as the file.
our pageCRA, NIS2, DORA and GDPR reporting clocks, with the notification drafted
Yes: the 24-hour, 72-hour and final-report clocks from the moment you became aware, the NIS2 and GDPR clocks on their own pages, and the notification drafted in the product from the record it already holds.
our pageDORA register of information generated from the contracts
Yes: in the product the ICT service contracts you hold are the register's rows, each with the data sheet of Implementing Regulation (EU) 2024/2956; on the site the vendor's own rows are written from its answers.
our pageHash-chained records with a published verifier
Yes: every record carries the hash of the one before it, the export carries the chain, and a published script recomputes it without us.
our pageImport from spreadsheets, every row confirmed by its owner
Yes: drop the Statement of Applicability, the risk register and the policies you keep; every row is staged, a person ticks what is written, and the rest is built.
our pagePacks bought without an account
Yes: the six packs are bought on the marketplace with a card and an email address, the files arrive by email, no account.
our pageThe site and the product in six EU languages
Yes: English, German, French, Dutch, Spanish and Danish, the site and the product, every page with its five alternates.
our pageNo consent banner
Yes: the site sets no cookies and shows no banner because there is nothing to consent to; the product sets the session cookie and one short-lived origin cookie, each listed.
our page
Each line links the page of ours that shows it. Vanta, Drata, Cyberday, Secureframe were read on 24 September 2026: the table with their cells and every source is on the comparison.
What is in the subscription
One price, every feature. Under it, what is sold separately.
Monthly
€249/mo
per organization, excl. VAT
- Month to month, renews until you cancel
- Cancel in the app, effective at the end of the month
- 7-day free trial, no card
| What is in it | Included |
|---|---|
| Management system | |
| ISO 27001, ISO 42001, ISO 9001, ISO 27701 and ISO 14001, on the same terms | Included |
| A Statement of Applicability with drafted justifications | Included |
| A risk register with treatments | Included |
| Internal audit and management review records | Included |
| The certified year on Today: what is due, when | Included |
| Evidence | |
| Evidence collected as it happens, dated, on a tamper-evident chain | Included |
| One-click export of every record, in open formats | Included |
| An auditor role that can read every record and change none | Included |
| Regulations | |
| CRA reporting: Article 14 events with the ENISA fields, and the 24-hour, 72-hour and 14-day clocks | Included |
| NIS2: the measures, the registration and the incident clocks | Included |
| DORA: the register of information, the contract clauses and the incident clocks | Included |
| GDPR: the record of processing, the breach clock and the request clock | Included |
| AI Act: the classification, the obligations and the Article 50 dates | Included |
| Data Act: the obligations by role and the three dates | Included |
| The determination tools on this site, free without an account | Free, no account |
| Integrations and checks | |
| One click to connect GitHub, Microsoft Entra ID and Google Workspace: the provider's own consent screen, and the checks run the same minute | Included |
| Read-only integrations: GitHub, identity providers, cloud accounts, Snyk, device management | Included |
| Automated checks that write evidence on a schedule | Included |
| A digest naming what is overdue and who owns it | Included |
| People and access | |
| Unlimited people, no per-seat charge | Included |
| SAML 2.0 single sign-on and an enforceable second factor | Included |
| Owner, admin, member and auditor roles | Included |
| A trust page of your own for customers, with an NDA gate if you want one | Included |
| In every subscription | |
| Every feature, no tiers | Included |
| One organization per subscription | Included |
| Hosted in the EU | Included |
| Support by email, answered within one business day | Included |
Not included:What the price does not cover
Prices in euro, excluding VAT. Paddle takes the payment and adds or reverse-charges the VAT for your country.
Add when you need it
One purchase for one situation; the download packs need no subscription.
- Applies from 11 Dec 2027
You make a product with digital elements
CRA technical file
List price €3,000
€2,000
33% off the list price, introductory, until 30 Nov 2026once, per product, excl. VAT
CRA file, one product
Bought once; 11 controlled documents drafted into your organization
Documents by email; add them to a free workspace whenever you like.
- Applies from 11 Dec 2027
You import or distribute one
CRA importer and distributor pack
List price €1,800
€1,200
33% off the list price, introductory, until 30 Nov 2026once, per organization, excl. VAT
CRA, importers and distributors
Bought once; 7 controlled documents drafted into your organization
Documents by email; add them to a free workspace whenever you like.
- Applies from 20 Jan 2027
You place a machine on the market
Machinery Regulation technical file
List price €3,000
€2,000
33% off the list price, introductory, until 30 Nov 2026once, per machine, excl. VAT
Machinery file, one machine
Bought once; 7 controlled documents drafted into your organization
Documents by email; add them to a free workspace whenever you like.
- Applies since 11 Sep 2026
You want the CRA work offline, without the system
CRA Readiness Toolkit
€199
once, per organization, excl. VAT
Offline: file, registers, runbook
Bought once; downloaded as files, yours to keep
- Applies since 17 Jan 2025
A bank or insurer sends you the DORA questionnaire
DORA Vendor Pack
€199
once, per organization, excl. VAT
Offline: clauses, register, due diligence
Bought once; downloaded as files, yours to keep
- Applies since 18 Oct 2024
You must register as an essential or important entity
NIS2 Registration Pack
€199
once, per organization, excl. VAT
Offline: worksheet, registration, runbook
Bought once; downloaded as files, yours to keep
- Applies from 30 Dec 2026
You place timber, cocoa, coffee, soya, rubber, palm or cattle products on the EU market
EUDR Due Diligence Statement Pack
€199
once, per organization, excl. VAT
Offline: statement, collection, assessment
Bought once; downloaded as files, yours to keep
- Applies since 28 Jun 2025
You sell consumer computers, phones, e-readers, terminals, e-commerce, e-books, banking or transport services
European Accessibility Act Pack
€199
once, per organization, excl. VAT
Offline: roles, requirements, declaration
Bought once; downloaded as files, yours to keep
- Applies since 17 Dec 2023
You employ 50 or more people and owe an internal reporting channel under your own state's act
Whistleblower Directive Pack
€199
once, per organization, excl. VAT
Offline: your act, channel, clocks
Bought once; downloaded as files, yours to keep
- Applies since 18 Feb 2024
You make, import, distribute or put on the market portable, SLI, LMT, industrial or electric vehicle batteries
Batteries Regulation Pack
€199
once, per organization, excl. VAT
Offline: calendar, documentation, declaration
Bought once; downloaded as files, yours to keep
- Applies since 12 Aug 2026
You pack anything you sell in the Union, in sales, grouped, transport or e-commerce packaging
Packaging Regulation Pack
€199
once, per organization, excl. VAT
Offline: formats, calendar, declaration
Bought once; downloaded as files, yours to keep
- Applies since 13 Dec 2024
You supply a consumer product in the Union, as its maker, importer, distributor, marketplace or responsible person
GPSR Product Safety Pack
€1,200
once, per organization, excl. VAT
Offline: roles, documentation, recall
Available soon
- Applies from 12 Jan 2027
You hold data a connected product or service generates, or you run a service a customer could switch away from
Data Act Pack
€1,200
once, per organization, excl. VAT
Offline: dates, roles, switching contract
Available soon
- Applies from 20 Jan 2027
You import a machine into the Union or make one available on it, rather than making it yourself
Machinery importer and distributor pack
€1,200
once, per organization, excl. VAT
Offline: both tracks, checks, records
Available soon
- Applies from 2 Dec 2027
You place a high-risk AI system on the Union market, or one is about to become high-risk under Annex III
AI Act technical documentation pack
€2,000
once, per organization, excl. VAT
Offline: Annex IV, QMS, declaration
Available soon
- Applies from 2 Dec 2027
You use a high-risk AI system that somebody else made, rather than making one yourself
AI Act deployer pack
€1,200
once, per organization, excl. VAT
Offline: Article 26, the grid, the notices
Available soon
Done for you
The same work as a pack, filled in by us for your machine or your company, at a fixed price.
- Machinery technical file, done for you€2,900 excl. VAT, once, per machineThe pack's 7 documents, filled for your machine.10 working days
- CRA technical file, done for you€2,900 excl. VAT, once, per productThe pack's 11 documents, filled for your product.10 working days
- NIS2 registration, done in a week€490 excl. VAT, onceScope decided and every field prepared, in 5 working days.5 working days
What each pricing page puts where the number should be
3 of the 10 vendors read on 4 October 2026 print no figure and put a button there instead. Printing a price is not ours alone: Cyberday, episki, Strike Graph, Hicomply, ComplyJet and LowerPlane do it too.
Cyberday
Yes€320 to €1,790 a month
Read 4 October 2026Vanta
No“Get personalized pricing”
Read 4 October 2026Drata
No“Get Started”
Read 4 October 2026Comp AI
No“Book my pricing call”
Read 4 October 2026- Read 4 October 2026
SecureSlate
Page gone episki
Yesfrom US$7,500 a year
Read 4 October 2026Strike Graph
YesUS$10,000 to US$35,000 a year
Read 4 October 2026Hicomply
Yes£5,300 to £10,600 a year
Read 4 October 2026ComplyJet
YesUS$7,999 to US$11,999 a year
Read 4 October 2026LowerPlane
YesUS$4,995 to US$15,995 a year
Read 4 October 2026
Button texts are quoted as each page printed them. What happens after the click is each vendor's process, and this table claims nothing about it. Compliance software without a sales call
Have it done with you
Two fixed-price engagements, remote, with StandardOS included while we work.
- CRA readiness€1,500 fixed, excl. VAT, paid up frontThe scope determination, the Annex I gap list for your product, reporting set up, and the technical file started in StandardOS, with a call to open and a call to close.10 working days from the opening call
- ISO 27001 gap assessment€1,200 fixed, excl. VAT, paid up frontA drafted Statement of Applicability, a gap list by clause and Annex A control, and a prioritised plan to certification, with a call to open and a call to close.10 working days from the opening call
What the price does not cover
Certification has costs beyond software, and a pricing page that hides them is setting up an unpleasant conversation later. Here is the whole list.
- The certification audit itself
- Paid to an accredited certification body, not to us. It is the larger number, and it is not optional, because a certificate comes from them. What the audit costs
- A copy of ISO/IEC 27001
- The standard is copyrighted and sold by ISO and by national standards bodies, whichever one serves your country. You do not strictly need a copy to use StandardOS, but you will want one.
- Consultancy
- We do not sell hours, and there is no implementation package to buy. The product drafts the documents; the judgement stays yours, or your consultant's. What no consultant can do is stay, and the years after the engagement are what the product is built for. Invite one in if you want; the records stay yours.
- Penetration tests, or anything an auditor asks you to procure
- Some controls are satisfied by evidence you buy elsewhere. StandardOS tracks that the evidence exists and when it expires; it does not produce it.
Billing, plainly
When am I charged?
Never during the 7-day trial, and not without a card you entered yourself. When the trial ends the workspace becomes read-only. It is not deleted, and you can still sign in, read everything and export it all.
Is VAT included?
No. €249 is excluding VAT, which is how B2B prices are quoted across the EU. VAT is added at checkout according to your country and whether you supply a valid VAT number. With a valid number the reverse charge usually applies and we add none.
What if we get stuck?
Email us. Support is included in the price and answered by us within one business day, not by a tiered help desk. Every screen explains what the clause behind it asks for, and when that is not enough, a person who knows the product answers. What you are not buying is a dependency: the system lives in the product and in your records, not in one person's head.
What if we grow?
Nothing changes. The price is per organization, not per seat, and there is no tier to move up to. A company of 8 and a company of 80 pay the same.
How do I cancel?
In the app, without emailing anyone. There is no minimum term and no notice period. Cancelling stops the next charge and leaves your data readable and exportable.
What you get for it, stated precisely
ISO 27001 has 26 requirement clauses. StandardOS covers 26 of them in full, and the register says, clause by clause and before you pay, where the product does less than you might assume.
Compared with Vanta, Drata, Cyberday, Secureframe, a consultant and spreadsheets
Related:PartnersFor consultantsWhat compliance software costsMarketplaceWhat certification costs
Try it before you decide
7 days, no card, and your Statement of Applicability is generated in the first fifteen minutes, so you find out whether this works for you well before there is anything to pay.