§ Pricing

Priced on what you cover, not on how many people use it.

You pay for the areas of your business you cover, and for frameworks beyond the Essential Eight, the ASD Essentials for enterprise IT and the one Growth includes. There are no per-user fees and no charge for how much you use it. Prices are not published yet: we are setting them with our first customers, and each one is agreed in a conversation against a written description of what is covered.

Free

See where you stand

No time limit

See what applies to you, what you are assuming, and where your records and your evidence disagree.

Free / no card
One area covered, with no time limit.
Frameworks Essential Eight and ASD Essentials for enterprise IT
Sharing Your team; customers on Frank planned

Includes

  • Included: Start from the spreadsheets, registers and ISOPlanner exports you already keep, or connect SharePoint or GitHub
  • Included: One record of the laws, rules and contract terms you are bound by, and where each one comes from
  • Included: A clear line around what you are vouching for, what you are leaving out and why
  • Included: Who owns what, and which safeguards rely on outside parties that nobody is checking
  • Included: A written list of what you are assuming and where you fall short, each with a date to check again
  • Included: Where your records and your evidence disagree, and what has gone out of date
  • Included: What each safeguard depends on, and how long its evidence counts before it needs refreshing
  • Included: Approved exceptions, who may approve them, and when each one expires
  • Included: New legislation, ASD’s cyber alerts, new editions of the ISM and software flaws that affect what you run, each put in front of a named person to review by a set date
  • Included: Your records back, on request once a year and whenever you leave: everything Frank holds for you, its findings included, as data in a format you can read without Frank
  • Included: Every decision kept, including ones later withdrawn or replaced
  • Included: Sign in with your existing company login, at no extra cost
  • Included: Sharing where an area stands with a customer who uses Frank, once built: they pay to rely on it, you do not pay to share it
  • Not included: Frank presenting your position to people not on Frank: its findings as a spreadsheet or PDF, including the Statement of Applicability, a public link, or auditor access. Your records are yours to share on any plan; Frank showing them for you is paid
  • Not included: A pass/fail certificate or a maturity score
Request access
Growth

Prove it to others

Dated statements of where you stand, and an ISO 27001 Statement of Applicability your auditor can use, across the areas that matter.

By area / never per user
One or more areas, priced per area.
Frameworks Essential Eight, ASD Essentials for enterprise IT + 1 of your choice
Sharing Exports now, public link planned

Everything in Free, plus

  • Included: Statements showing what each covers, who signed it, when it expires and the rules it was judged by, with a public link to share them planned
  • Included: As many areas as you need, priced per area: products, shared services, key suppliers
  • Included: Areas nested under one another, so a shared service’s safeguards count for every product that uses it
  • Included: Every area rolled up, so you can see where the whole organisation stands
  • Included: Each area’s lead grants access and signs off decisions for their own part
  • Included: One more framework of your choice, such as ISO 27001, NIST CSF or the ISM, and a flat charge for each after that
  • Included: One set of work mapped to every framework you take
  • Included: An ISO 27001 Statement of Applicability your auditor can use, as a spreadsheet or PDF
  • Included: Where each piece of evidence came from, and which suppliers you rely on without proof
  • Included: Relying on what your suppliers share with you through Frank as evidence for your own safeguards, once built
Get early access
Enterprise

Prove it at scale

Bespoke

For a parent company and its subsidiaries: every company under one view, hosting arranged to your requirements, and priority support, on terms agreed in a contract.

Bespoke / agreed in a contract
A parent company and its subsidiaries under one view.
Structure Parent and subsidiaries
Hosting Arranged for you

Everything in Growth, plus

  • Included: A parent company and its subsidiaries under one view, each signing in through its own identity provider
  • Included: Hosting arranged to your requirements, such as an environment for your organisation alone
  • Included: Priority support
  • Included: Contract, invoicing and procurement terms agreed with you
Contact sales
Principle 01

Frameworks add, they don’t multiply. Growth includes one of your choice. Each one after that is a single charge, not charged again for every area you cover.

Principle 02

Using Frank is not metered. Recording decisions, exceptions and evidence is never charged, however much of it you do.

Principle 03

Fixing things faster never costs more. Owning up to a problem never adds a fee.

§ FAQ

Frequently asked, plainly answered.

If a question isn't here, write to us. We update this page as the questions repeat.

Why is there no list price?
We are setting prices with our early customers, not before them. When prices are published they will be in AUD excluding GST, and set against what you already spend on audit preparation, external assessment and the risk of signing off on something that turns out to be untrue, not against what per-user compliance tools charge. Until then, every price is agreed in a conversation, against a written description of what is covered. GST is added where it applies and shown on the tax invoice.
Why no per-user pricing?
Each person in Frank is someone responsible for something, so we do not want you to limit who uses it. Per-user pricing penalises the people you most need involved, such as owners, reviewers and auditors, and encourages shared logins or leaving things without a named owner. We charge for the areas you cover and for frameworks beyond the Essential Eight, the ASD Essentials for enterprise IT and the one Growth includes.
What counts as an area?
A part of the business you vouch for: a product, a shared service, a key supplier or a business unit. Each has its own status, named owners, recorded decisions, and evidence with end dates. An area nested under another is an area in its own right and is counted: nesting changes who decides and how status rolls up, never what an area costs. The free plan includes one area, with nothing nested under it.
What is a framework?
A standard or set of government requirements that Frank maps your one set of work onto, such as ISO 27001, NIST CSF or the Essential Eight. The Essential Eight and the ASD Essentials for enterprise IT are free on every plan, Growth includes one more of your choice, and each one after that is a single charge, not multiplied across every area you cover. Every framework is available on Growth; none is held back for a higher plan.
Do you charge for single sign-on?
No. Signing in with your own company login is included in every plan.
Will the price go up if we record more exceptions?
No. Recording exceptions, updating evidence, logging decisions and accepting risks are the everyday work Frank exists for, so they are never charged. Frank may mark something as less certain until its evidence is brought up to date, but the bill does not change.
Is Frank free for small businesses?
Yes, for baseline government-published security standards: in Australia, the Essential Eight and the enterprise IT chapter of the ASD Essentials, which is succeeding it. The Essential Eight is mandatory only for Commonwealth departments and agencies and members of the Defence Industry Security Program, or where a contract requires it, but many smaller organisations are asked to meet these standards, and we will not charge for that.
What if we do not keep our records anywhere in particular?
You can start without them. Controls, commitments, assumptions and decisions can be written directly in Frank. A control you write in Frank is not assumed to work. When it is included in an assessment, Frank reports what the available information supports, including unsupported or contradicted where warranted. Anything you write only in Frank is held only in Frank. You can take all of it out in the complete export described on our continuity page, but outside termination that is once a year, on request, so decide whether that is enough for you before relying on it. Evidence is different: Frank points to it and is not a store for it. The contents of a file you upload are held only so we can replay ingestion, for your retention window (30 days by default, 365 at the most), and are then erased, as our terms set out. So evidence needs a home you control, even if that is a shared drive.
How is the free plan different from a trial?
It is not a trial. It is a complete view of one area: what applies, what is assumed, what nobody is checking, and where your records and evidence disagree. There is no time limit, no card and no prompts to upgrade inside the product. You pay when you need Frank to show your position to someone else: Growth adds an auditor-ready Statement of Applicability now, and a public link to share your statements once it is built.
Is a paid statement the same as a free one?
Yes. It is the same product, reading the same records by the same rules, and the same named person in your organisation signs it. Nothing is checked again, rebuilt or judged more strictly when you move to Growth, and your records, decisions and evidence carry over as they are. What Growth adds is the means to show your position to people who are not on Frank, such as an auditor, a buyer or an insurer, and room for more areas and frameworks. Sharing with a customer who already uses Frank is free on every plan once it is built.
Where is my data held, and what happens if I leave?
The application and its database run in Sydney, Australia, and everything we store of your content is held in Australia. The one exception is the OSV feed, if you turn it on: the names and versions of the packages you declare are sent to OSV, which is operated from the United States and may keep them. Frank keeps pointers to the records in your own systems rather than copies of them, and connections are read-only. If you leave, you have 30 days to ask for the complete export of your records, and we deliver it within that time. We then delete or de-identify what we hold within a further 30 days, subject to backups expiring and anything the law requires us to keep. The sub-processors and hosting page and the continuity and exit page set this out in full.
Can I move between plans?
Yes. Growth includes everything in Free, and Enterprise includes everything in Growth. Your data stays where it is, and we do not make it hard to take it elsewhere.
Not sure where you fit?

Start by seeing where you stand.

In the first week, Frank looks for four things: a requirement nothing covers, a supplier nobody is checking, an assumption nobody wrote down, and a record your own evidence contradicts. None of those need an enterprise contract.

Request access Talk to us