Priced per firm.
Never per seat.
Never per client, never per export, never per assessment. One call, one scoped number, and it does not move when you win the next client.
- Per seat
- Per client
- Per assessment
- Per export
- Per SPRS submission
For consulting firms & RPOs
You attest other people's organizations. One installer, one control plane, isolated tenants inside.
Starter
For solo consultants or small firms proving the model.
Priced on up to 3 clients
Request pricing- Multi-tenant client roster — up to 3 client SMBs, 1 consultant seat
- Full CMMC L2 v2.13 assessment — 110 practices + 320 objectives, verbatim
- Evidence upload + firm-scoped storage
- POA&M with DoD 180-day countdown
- SPRS score calculation + immutable history
- SSP export as C3PAO-standard XLSX + PDF
- 18-template policy engine with review / approve / accept
- Audit log of every action
Pro
Real consulting-firm operations.
Priced on your roster, once
Request pricing- Everything in Starter, plus:
- Unlimited client SMBs + unlimited consultant seats
- Teammate invites + role management — owner / admin / consultant
- Per-client policy templates + custom merge fields
- Per-firm branding on SSP + policy exports coming
- Bulk assessment operations coming
- Priority support + onboarding call
For contractors attesting themselves
A different shape of product — no client roster, no consultant workflow, just your own attestation.
DIB SMB — Direct
Skip the consultant. Attest on your own.
Priced per box · one attestation
Request pricing- Single-tenant workspace — just your org
- The same full CMMC L2 assessment workspace the firms use
- Evidence + POA&M + SPRS + C3PAO-standard SSP export
- Verbatim DoD-CIO assessment content — no paraphrasing
- No consultant workflow — no client roster, no review / approve
- Upgrade into a firm tier at any time, nothing re-keyed
Why there is no number on this page. A ten-client firm and a two-hundred-client firm run the same software on the same box; charging either of them a seat rate would be arithmetic, not pricing. We scope to your book of business once, and the figure doesn't move when you win the next client.
The audit path is
in every tier.
| Feature | Starter | Pro | Direct |
|---|---|---|---|
| Client tenants | Up to 3 | Unlimited | Your org only |
| Consultant seats | 1 | Unlimited | — |
| CMMC L2 assessment · 110 + 320 | |||
| Evidence · POA&M · SPRS | |||
| C3PAO-standard SSP export | |||
| 18-template policy engine | |||
| Review / approve / accept flow | — | ||
| Teammate roles + invites | — | — | |
| Per-client policy templates | — | — | |
| Per-firm export branding | — | soon | — |
| Bulk assessment operations | — | soon | — |
| Priority support + onboarding | — | — | |
| Audit-ready guarantee | |||
| Runs on your hardware |
Four steps.
No procurement theatre.
- 01One callTwenty minutes. How many clients, what your engagement looks like, where it will run.
- 02A scoped numberA single annual figure for your firm. It does not move when you win the next client.
- 03A signed tarballTarball plus detached checksum. Verify it before you install — that is the deal.
- 04Ten minutes to liveOne command on your Ubuntu box. Docker, Postgres, nginx, TLS, schema, RLS.
Audit-ready
or your year back.
Complyology guarantees your exported attestation package will pass a C3PAO readiness review on the four things that actually cause rejection.
If a C3PAO rejects the package on any of the guaranteed grounds, we re-run the attestation at no charge — or refund the year in full. Every release, every tier.
— The four guarantees
- 01Content fidelityEvery practice and objective is verbatim from the DoD-CIO CMMC L2 Assessment Guide v2.13 and NIST SP 800-171 Rev 2.
- 02C3PAO-standard formatSSP export is the NIST 800-171 Rev 2 companion workbook layout — Cover / System Info / Practice Matrix / Objectives / POA&M / Evidence.
- 03Byte-for-byte SPRS calcMatches the DoD Assessment Methodology v1.2.1 calculator — 44 × 5-point + 14 × 3-point + 52 × 1-point weights.
- 04Canonical DoD logicSubmit-lock triggers freeze the audit trail on submission — the exported package matches your immutable database state.
What you'd ask
on the call anyway.
What counts as a client?
One defense-contractor organization you attest, living as its own isolated tenant inside your firm. A client with four sites and three contracts is still one client — the unit is the org you are producing an SSP for, not the work you do for it.
Do we pay per assessment, per export, or per SPRS submission?
No, no, and no. The number is annual and per firm. Running a second assessment for the same client after remediation, re-exporting an SSP, or regenerating a policy set costs nothing extra — charging for those would penalize exactly the behavior that gets a client certified.
What happens when we win clients mid-year?
On Pro, nothing. The roster is unlimited and the figure does not move until renewal. On Starter, the third client is the ceiling — that tier exists to prove the model, and crossing it is the signal to move to Pro.
Is there a per-seat charge for consultants?
Not on Pro. Seat-based pricing on a compliance tool creates an incentive to share logins, which quietly destroys the audit trail — the AU.L2-3.3.2 requirement that every action trace to an individual user account. We would rather charge once and have everyone log in as themselves.
Our firm grows. What happens at renewal?
We look at the book of business again and re-scope if it has genuinely changed shape. There is no automatic escalator and no true-up invoice mid-term.
Can we start on Direct and move to a firm tier later?
Yes. The single-tenant workspace becomes the first tenant in your firm's roster, with scoring, evidence and history intact. Nothing is re-keyed.
Trade your chaos
for submitted SPRS scores.
One call, one scoped number, one signed tarball. Nothing phones home.