Pricing and plans

Commercial truth for humans and agents. Canonical marketing page: heygrc.com/pricing (re-check numbers there if this page ages). Manage billing, extras (on-demand reviews), and the extras spend cap in the console: app.heygrc.com/billing.

heyGRC charges for PR reviews on private repositories, not seats and not per-repository tax. Public repositories are free, 500 reviews per organization per month.

What counts as a PR review (paid plans)

• A PR review is one pull request per billing period. Re-pushes to that pull request do not count again.
• On paid plans and the trial, every push gets a review, up to 20 automatic reviews per PR per period (Free: up to 5). After that, comment /heygrc on the PR to request another review.
• Subscriptions that started before 30 September 2026 switch to PR counting at their next renewal; until then each review run counts.

Fair use: hourly and daily limits apply on every plan, higher on paid plans. They are separate from your monthly allowance.

14-day trial

Claiming your install in the console (app.heygrc.com) starts a 14-day trial with up to 500 private PR reviews, no credit card. Re-pushes to a pull request during the trial do not count again, up to 20 automatic reviews per PR. After that, comment /heygrc on the PR to request another review. Installs that are never claimed keep running on the Free plan. When the trial ends, the org falls back to the Free plan automatically. You only pay if you choose to upgrade.

Free

• $0 / month
• 10 private pull requests per month (hard cap), up to 5 reviews per pull request
• Public repositories free, 500 reviews per organization per month (do not count against the private free cap)
• Same product surface as paid: frameworks, config API, PR reviews

If Free private pull requests are used up for the month, upgrade or wait for your monthly window to reset. Public-repo reviews keep running, up to 500 per organization per month.

Paid plans (usage ladder)

Same product surface on every paid tier. Difference is how many PR reviews are included each month.

Existing subscriptions keep their price.

All paid plans:

• All private repositories under the org
• Full framework catalog
• Inline findings + GitHub check status
• Self-serve checkout and portal from the console

Invoice / bank transfer is available for Business annual only (€4,788 / year, 2,000 PR reviews a month, extras off). Request it on the pay by invoice form after creating a free org at app.heygrc.com. Starter and Pro stay on card checkout. UK customers pay through Paddle, not this path.

Included with ISMS Copilot

Paid ISMS Copilot plans (Standard, Pro, Business, Unlimited) include heyGRC: 100 private PR reviews per month (2,000 on Unlimited), counted once per pull request, on one org at a time, at no extra cost. Same product surface as any paid tier. Public repos stay free, 500 reviews per organization per month.

Who qualifies. An active ISMS Copilot subscription on a qualifying plan. ISMS Copilot trials do not qualify. On a team plan, the account that pays for the team qualifies, not each seat. Already paying for heyGRC? Nothing changes: a Stripe plan on the org keeps its own allowance and billing and takes precedence.

How to activate. Sign in to app.heygrc.com with the same account you use for ISMS Copilot (one login across both products), install and claim the GitHub App on the org if you have not yet, then open the Plan page and activate. Nothing attaches automatically.

No on-demand on the inclusion. The included 100 is a hard stop. Private reviews past it get the neutral check, public repos keep running, nothing is billed. Need more, pick a heyGRC plan (Starter $39 / Pro $149 / Business $399) and it applies instead of the inclusion, with its own included reviews and its own on-demand switch.

Pause and resume. If the ISMS Copilot subscription lapses, the inclusion pauses: the org falls back to Free rules, keeps its install, settings and history, and resumes with the same month balance when the subscription is active again. Nothing to reactivate.

FAQ

Does it cost extra? No. It is part of the ISMS Copilot plan price.

Do I need a second account? No. Same login. Sign in to the console with the account that pays for ISMS Copilot.

Can I split the 100 across two orgs? No. One org at a time. You can move it from the Plan page, but usage counts per month for the sponsoring account across every org it has been on, so moving does not give you a second 100.

Do the included reviews stack on top of a paid heyGRC plan? No. A Stripe plan on the org supersedes the inclusion; the inclusion sits dormant and comes back if the plan ends.

Can I buy top-ups or turn on on-demand for an included org? No. Those belong to the paid heyGRC plans.

Does the 14-day trial still apply? Yes, independently. Claiming an install still starts the trial. Included reviews are counted separately from trial reviews.

Where do I see usage? The Plan page shows an included with ISMS Copilot badge and a usage bar for the current month.

Going over your plan

First time over: 25% more, free, once. The first time a paid org goes over its plan, it gets 25% more PR reviews at no charge. This happens once per org and is never billed.

After that, one of two things happens:

1. Extras (on-demand reviews) on. PR reviews past your plan are billed at $0.49 per PR review (Stripe metered), and reviews keep running up to the extras spend cap.
2. Extras off. Private reviews pause until the next billing period, with a neutral check on the PR explaining why. You are not charged past your plan.

Extras are off unless an owner turns them on, at checkout or later in the console (app.heygrc.com/billing). When turned on at checkout, the monthly cap defaults to the plan price and can be changed in the console. At the cap, extra private reviews pause. GitHub and Origin show a neutral check with a link to billing, and do not show the dollar amount. Included PR reviews and public repositories are not counted toward the cap.

You can also upgrade to a larger plan (more included PR reviews) at any time.

GitHub shows a neutral check (does not block merge) with a link to the console when a review is skipped for plan limit or spend cap.

You can turn extras off anytime, and you can change the cap anytime. Public repositories stay free either way.

What you are not charged for

• Seats / engineer count
• Number of repositories (beyond private PR review caps above)
• Re-pushes to a pull request already counted this period
• Public-repository reviews
• The first-overrun 25% extra PR reviews
• Private reviews past your plan while extras are off (those reviews pause)

Related

• Set up with your agent
• Console and API keys
• Live pricing UI: heygrc.com/pricing
• ISMS Copilot side of the inclusion: docs.ismscopilot.com