Pricing and plans
heyGRC Free, Starter, Pro, and Business plans. Included private reviews hard-stop unless you enable on-demand at $0.49 each. Public repos always free.
Commercial truth for humans and agents. Canonical marketing page: heygrc.com/pricing (re-check numbers there if this page ages). Manage billing and on-demand in the console: app.heygrc.com/settings.
heyGRC charges for reviews run on private repositories, not seats and not per-repository tax. Public repositories are always free.
14-day trial
Claiming your install in the console (app.heygrc.com) starts 14 days of unlimited private reviews, no credit card. Installs that are never claimed keep running on the Free plan. When the trial ends, the org falls back to the Free plan automatically. You only pay if you choose to upgrade.
Free
- $0 / month
- 25 private reviews per month (hard cap)
- Public repositories always free (do not count against the private free cap)
- Same product surface as paid: frameworks, config API, PR reviews
If Free private reviews are exhausted for the month, upgrade or wait for the next month. Public-repo reviews keep running.
Paid plans (usage ladder)
Same product surface on every paid tier. Difference is how many private reviews are included each month.
| Plan | Price | Included private reviews / month |
|---|---|---|
| Starter | $19 / org / month | 100 |
| Pro | $99 / org / month | 500 |
| Business | $249 / org / month | 2,000 |
All paid plans:
- All private repositories under the org
- Full framework catalog
- Inline findings + GitHub check status
- Self-serve checkout and portal from the console
Invoice / bank transfer is available for Business annual only (€2,988 / year, 2,000 included private reviews, on-demand off). Request it on the pay by invoice form after creating a free org at app.heygrc.com. Starter and Pro stay on card checkout. UK customers pay through Paddle, not this path.
Included with ISMS Copilot
Paid ISMS Copilot plans (Standard, Pro, Business) include heyGRC: 100 private reviews per month, on one org at a time, at no extra cost. Same product surface as any paid tier. Public repos stay free as always.
Who qualifies. An active ISMS Copilot subscription on a qualifying plan. ISMS Copilot trials do not qualify. On a team plan, the account that pays for the team qualifies, not each seat. Already paying for heyGRC? Nothing changes: a Stripe plan on the org keeps its own allowance and billing and takes precedence.
How to activate. Sign in to app.heygrc.com with the same account you use for ISMS Copilot (one login across both products), install and claim the GitHub App on the org if you have not yet, then open the Plan page and activate. Nothing attaches automatically.
No on-demand on the inclusion. The included 100 is a hard stop. Private reviews past it get the neutral check, public repos keep running, nothing is billed. Need more, pick a heyGRC plan (Starter $19 / Pro $99 / Business $249) and it applies instead of the inclusion, with its own included reviews and its own on-demand switch.
Pause and resume. If the ISMS Copilot subscription lapses, the inclusion pauses: the org falls back to Free rules, keeps its install, settings and history, and resumes with the same month balance when the subscription is active again. Nothing to reactivate.
FAQ
Does it cost extra? No. It is part of the ISMS Copilot plan price.
Do I need a second account? No. Same login. Sign in to the console with the account that pays for ISMS Copilot.
Can I split the 100 across two orgs? No. One org at a time. You can move it from the Plan page, but usage counts per month for the sponsoring account across every org it has been on, so moving does not give you a second 100.
Do the included reviews stack on top of a paid heyGRC plan? No. A Stripe plan on the org supersedes the inclusion; the inclusion sits dormant and comes back if the plan ends.
Can I buy top-ups or turn on on-demand for an included org? No. Those belong to the paid heyGRC plans.
Does the 14-day trial still apply? Yes, independently. Claiming an install still starts the trial. Included reviews are counted separately from trial reviews.
Where do I see usage? The Plan page shows an included with ISMS Copilot badge and a usage bar for the current month.
On-demand reviews (opt-in past included)
By default, when a paid org uses its included private reviews for the month, heyGRC stops reviewing private PRs. You are not charged past the included allotment unless you opt in.
In the console (app.heygrc.com/settings) you can:
- Enable on-demand reviews — private reviews past included are billed at $0.49 each (Stripe metered), and reviews keep running, or
- Upgrade to a larger plan (more included reviews).
GitHub shows a neutral check (does not block merge) with a link to the console when a review is skipped for plan limit.
You can turn on-demand off anytime. Public repositories stay free either way.
What you are not charged for
- Seats / engineer count
- Number of repositories (beyond private review caps above)
- Public-repository reviews
- Private reviews past included while on-demand is off (those reviews simply do not run)
Related
- Set up with your agent
- Console and API keys
- Live pricing UI: heygrc.com/pricing
- ISMS Copilot side of the inclusion: docs.ismscopilot.com