One platform. One price.

Every paid plan can be billed monthly or annually. Monthly is £600 on Start, £1,500 on Grow and £3,000 on Scale. Pay annually instead and you save 17%: £6,000, £15,000 and £30,000 for the year. The price you see here is the price you are charged — there is no separate list price, setup fee or per-framework charge. Upgrades are prorated, so moving up a tier mid-cycle only costs the difference.

Each plan includes a fixed number of seats — 5 on Start, 15 on Grow and 50 on Scale. On Enterprise the seat count is agreed in your Order Form. When your team grows past your allotment, you simply move up a tier — no surprise per-user charges. Your data and configuration carry over untouched.

Any team member with a login to the platform. Read-only auditors and external vendors completing questionnaires don’t consume a user seat — so collaboration never costs you headcount.

Every module is on every plan: risk, compliance automation, vendor risk, incident response, threat intelligence, the Horizon AI Copilot, the Trust Centre, executive dashboards and policy management — plus every compliance framework and every integration. Nothing is metered by module, by framework or by integration. What changes as you move up is the number of included users and the level of service: your support target, hands-on onboarding, quarterly business reviews and a named customer success manager. Two things do sit higher: SSO/SAML (SAML 2.0 / OIDC) comes in on Scale, and white-label, multi-org and dedicated single-tenant infrastructure are Enterprise. MFA is on every plan for every user, and you can enforce it through your own identity provider.

No. Every plan carries the full framework catalogue and every integration, with no per-framework, per-integration or per-module fee. If you add a framework in month six, your invoice does not change. The only things that change your price are the number of users you need and the service level you choose.

They are not all at the same depth, and we would rather you knew that before you buy. 10 are verified control-by-control against the published standard. The remaining 61 are curated crosswalk catalogues — control sets mapped from our verified libraries, useful for gap analysis and evidence reuse, but not independently reconciled clause by clause. Every framework is labelled with its status in the product, so you always know which you are looking at.

Critical (S1) response targets, from clause 4.2 of our published Service Level Agreement: 8 business hours on Start, 4 on Grow, 2 on Scale, and custom targets agreed in the Order Form on Enterprise. These are measured against UK business hours — we do not run a staffed 24/7 desk, and clause 4.3 says so; outside business hours S1 incidents are monitored on a best-efforts basis via an alerting channel. Grow and above also add hands-on onboarding.

Prices are set and billed in GBP. If you’re outside the UK, your card provider converts at its standard rate, and we’re happy to include indicative USD or EUR figures on a quote. Custom-currency invoicing is available on Enterprise.

Your data is stored in the European Union — AWS eu-west-1, in Ireland — on every plan. We would rather be precise than wave a flag at you, so: some processing happens outside the EU. Application hosting and serverless compute, identity management, AI features, transactional email, malware scanning of uploaded files and encrypted off-site backups all run with US-based providers, under the transfer safeguards set out in our DPA. Every one of them is named in our public sub-processor list with the region it processes in. Your residency region is elected on the Order Form — European Union (the default, Supabase eu-west-1), United States, United Kingdom or APAC — with no tier condition attached; a dedicated regional project is provisioned before any data is loaded. There is no managed region in the Middle East. Dedicated single-tenant infrastructure is an Enterprise capability.

Yes — upgrade anytime and we prorate the difference. Your data and configuration carry over untouched, and hands-on onboarding (Grow and above) helps you roll out the new capabilities. The company-size bands are a guide, not a hard limit — if you’re near a boundary we’ll size the plan to you.

We target 99.5% monthly uptime, with measurement, exclusions and service credits set out in our Service Level Agreement. Scale and Enterprise also include faster support-response targets.

Plans renew automatically so your programme never lapses. To stop renewal, give us at least 30 days’ notice before the end of your term by emailing support@cyberhorizon.co. Cancelling stops the next renewal — annual plans run to the end of the paid term (no mid-term refund), and monthly plans end at the close of the current cycle. You keep access until then, and can export your data on exit. Full details are in our Terms of Service.