Simple, transparent pricing.

Yes, you can upgrade or downgrade at any time. Changes take effect at the start of your next billing cycle.

Yes. Eligible free accounts can start a 7-day Plus trial, no card. Other paid plans do not start with a trial.

We accept all major credit cards. Bank transfer and invoice are available on annual plans of $1,000/year and above, on request.

Yes, you can cancel your subscription at any time. You'll continue to have access until the end of your billing period.

Yes. Any paid plan supports teams. The first person creates a team in Settings → Team and invites colleagues by email. One plan covers the whole team: teammates are free (up to 50 members), and the team shares the plan's usage pool for chat, uploads, and agent usage instead of paying per seat. Members share team workspaces; personal workspaces stay private.

Yes, on Standard, Pro, Business, and Unlimited. heyGRC, our pull request compliance review product, comes with those plans: 100 private PR reviews a month on Standard, Pro, and Business, and 2,000 on Unlimited, on one GitHub or Origin organization. A PR review counts one pull request once a month; re-pushes to the same pull request do not count again. Public repositories stay on the platform 500 reviews per organization per month fair-use cap; they are not unlimited. Activate it at app.heygrc.com with the same account you use for ISMS Copilot. When the inclusion is used up, reviews pause with a link to pick a heyGRC plan; there is no buffer on the inclusion. The inclusion pauses if your ISMS Copilot subscription lapses and resumes when it restarts. ISMS Copilot trials do not qualify.

Plus through Business include 500 uploads per month (fair use). Unlimited has no monthly upload cap, and upload top-up is not offered on that plan. On capped paid plans, when fewer than 100 uploads remain in the current month, hovering the paperclip (Attach file) icon in the chat input shows a countdown (e.g., "87 of 500 remaining"). On the Free plan the tooltip always shows your remaining uploads. At the limit, the upload button greys out and offers a top-up (capped paid plans) or an upgrade (Free).

On the 1st of each calendar month at 00:00 UTC. Only successful uploads count against your limit. Files that fail mid-processing don't count.

Yes. ISMS Copilot is specialist AI for GRC work: drafting policies, running risk assessments, mapping controls across frameworks, and preparing audits on ISO 27001, SOC 2, GDPR, NIS 2, DORA, HIPAA, ISO 42001, the EU AI Act, and 150+ frameworks in total across 20 jurisdictions.

What an AI GRC assistant does

You can ask questions about compliance frameworks and get expert guidance, upload documents for gap analysis and compliance checking, generate policies, procedures, and audit-ready documents, prepare for audits, review audit reports, and analyze risk assessments, create workspaces to organize multiple client projects, and get implementation guidance based on real consulting experience.

No. It's actually built to be their best assistant! ISMS Copilot accelerates compliance work by handling time-consuming tasks like policy writing and document analysis, but it's not a replacement for professional expertise. Use it to speed up your workflow, get quick framework guidance, and generate first drafts. You focus on strategic decisions and client relationships.

You can upload PDF, DOCX, and XLS files for analysis. The system handles documents of various sizes, including 20+ page reports, policies, and procedures.

Your database and files are stored in the EU (Frankfurt), with encrypted backups in Amsterdam. By default, AI runs on open-source models via OpenRouter (US); turn on Advanced Data Protection to run AI only on Mistral AI in Frankfurt. Transfers to our US providers, for AI routing and email, are covered by Standard Contractual Clauses.

You control your data retention settings (from 1 day up to 7 years maximum). Temporary chats are automatically deleted after 30 days. You can request data deletion or export at any time through our support team.

No. ISMS Copilot is an independent company with no affiliation to ISO, NIST, AICPA, or other standards organizations. We provide tools to help implement frameworks, but you must obtain official standards from authorized sources like ISO or NIST.

No. ISMS Copilot does not reproduce copyrighted materials. Our knowledge base is built from our consulting company's real-world implementation experience, not from copying official standards documents.

Yes! Visit chat.ismscopilot.com to start using ISMS Copilot for free. You can explore features, upload files, and generate documents before deciding to upgrade.

Simply visit chat.ismscopilot.com and create an account. You can start asking compliance questions, uploading documents, or creating workspaces immediately.

Visit chat.ismscopilot.com/support for support with technical issues, account management, or compliance questions. We respond to technical issues within 24 hours and general questions within 48 hours.

Yes! Workspaces let you organize compliance work by client or project. Each workspace can have custom instructions, uploaded files, conversation history, and separate settings, making it easy to manage multiple implementations without mixing information.

Be specific with questions (e.g., "ISO 27001 Annex A.8.1"), always verify outputs against official documentation, use workspaces to organize by client/project, upload your own framework requirements for customized guidance, and use ISMS Copilot as a starting point alongside professional expertise.

Yes. Founded in France, ISMS Copilot is built with GDPR compliance as a core principle. We offer EU data residency, transparent privacy policies, full data subject rights (access, correction, deletion, export), and minimal data collection.

We ship continuously: broader framework coverage, faster responses, stronger team collaboration, and deeper agent integrations. The developer API, account agents (MCP), and embed are already live; see the products hub for current surfaces.

See live products